Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache ActiveMQ running on the remote host is prior to 5.19.3 / 5.19.4 or 6.x prior to 6.2.2 / 6.2.3.
It is, therefore, affected by an improper validation and restriction of classpath path name vulnerability:

  - An authenticated user could exploit path concatenation to traverse the classpath in two specific contexts: when     creating a Stomp consumer and when browsing messages via the Web console. This vulnerability enables classpath path     resource loading that could potentially be combined with other attacks for exploitation. (CVE-2026-33227)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client,
    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when
    creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided
    "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the
    application is exposed to a classpath path resource loading vulnerability that could potentially be
    chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before
    5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache
    ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0
    before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to
    version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is
    limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
    (CVE-2026-33227)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client,     Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when     creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided     key value could be constructed to traverse the classpath due to path concatenation. As a result, the     application is exposed to a classpath path resource loading vulnerability that could potentially be     chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before     5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache     ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0     before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to     version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is     limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
    (CVE-2026-33227)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	high
305954	Apache ActiveMQ < 5.19.3 / 5.19.4, 6.x < 6.2.2 / 6.2.3 Classpath Path Traversal	Nessus	CGI abuses	medium
440079	SCA: security update for org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker, org.apache.activemq:activemq-client, org.apache.activemq:activemq-web (GHSA-h2h4-5m64-m273)	Tenable Cloud Security	SCA Checks	medium
440079	SCA: security update for org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker, org.apache.activemq:activemq-client, org.apache.activemq:activemq-web (GHSA-h2h4-5m64-m273)	Tenable Self-Hosted Container Security	SCA Checks	medium
305218	Linux Distros Unpatched Vulnerability : CVE-2026-33227	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-33227

medium

Tenable Plugins

high

medium

medium

medium

medium