An attacker must be an authenticated client of the ActiveMQ broker. The issue arises when that client can supply identifiers associated with another user's connection, session, or consumer state.
They can consume from another connection's temporary queue or topic, tear down a victim's live subscription through a duplicate ConsumerId registration followed by RemoveInfo or disconnect, or permanently delete an in-flight unacknowledged message by forging a MessageAck for the victim's ConsumerId.
Affected releases are Apache ActiveMQ and ActiveMQ Broker 6.0.0 through before 6.3.3, and releases before 5.19.12. Apache ActiveMQ KahaDB is affected in the same version ranges.
Upgrade to version 6.4.0, 6.3.3, or 5.19.12, as recommended in the advisory.