Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in
    Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary
    directories via unspecified vectors. (CVE-2015-1830)

Versions 5.x.x of Apache ActiveMQ prior to 5.11.2 are affected by a directory traversal vulnerability due to improper sanitization of user-supplied input in the fileserver upload and download functionality. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to read and upload arbitrary JSP files, resulting in the execution of arbitrary commands.

The version of Apache ActiveMQ running on the remote host is affected by a directory traversal vulnerability due to improper sanitization of user-supplied input in the fileserver upload and download functionality. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to read and upload arbitrary JSP files, resulting in the execution of arbitrary commands.

ID	Name	Product	Family	Severity
409693	SCA: security update for org.apache.activemq:activemq-client (GHSA-3v63-f83x-37x4)	Tenable Cloud Security	SCA Checks	medium
409693	SCA: security update for org.apache.activemq:activemq-client (GHSA-3v63-f83x-37x4)	Tenable Self-Hosted Container Security	SCA Checks	medium
9079	Apache ActiveMQ 5.x < 5.11.2 Blob Message Directory Traversal	Nessus Network Monitor	CGI	medium
85580	Apache ActiveMQ Blob Message Directory Traversal	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2015-1830

medium

Tenable Plugins

medium

medium

medium

medium