CVE-2016-3088: Apache ActiveMQ Improper Input Validation Vulnerability
Apache ActiveMQ could allow a remote attacker to execute arbitrary code on the system, caused by an error in the Fileserver web application. By sending a specially crafted HTTP PUT request and an HTTP MOVE request, an attacker could exploit this vulnerability to create an arbitrary file and execute arbitrary code on the system.
Other sources
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.activemq:activemq-clientto a version that resolves this vulnerability.Fixed in 5.14.0
Event History
Frequently Asked Questions
What is CVE-2016-3088?
CVE-2016-3088 is a vulnerability in Apache ActiveMQ that allows a remote attacker to execute arbitrary code on the system.
How does CVE-2016-3088 work?
CVE-2016-3088 is caused by an error in the Fileserver web application of Apache ActiveMQ. By sending a specially crafted HTTP PUT request and an HTTP MOVE request, an attacker can exploit this vulnerability to create an arbitrary file and execute arbitrary code.
What is the severity of CVE-2016-3088?
CVE-2016-3088 has a severity rating of 9.8 out of 10, which is considered critical.
What software is affected by CVE-2016-3088?
Apache ActiveMQ versions up to and including 5.13.3 are affected by CVE-2016-3088. IBM Security Directory Suite VA versions up to and including 8.0.1.19 are also affected.
How can CVE-2016-3088 be mitigated?
To mitigate CVE-2016-3088, users should upgrade to a fixed version of Apache ActiveMQ or IBM Security Directory Suite VA.