Log in Start free

Vulnerability · Published Sep 10, 2020 · Assigned by apache

CVE-2020-11998

Critical 9.8

In plain English

A critical-severity security flaw in Apache ActiveMQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 48.9% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)48.9%top 1.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.activemq:activemq-parent5.15.13GHSA-wqfh-9m4g-7x6x
Ubuntu:24.04:LTSactivemqno fix listedUBUNTU-CVE-2020-11998
Ubuntu:25.10activemqno fix listedUBUNTU-CVE-2020-11998
Ubuntu:26.04:LTSactivemqno fix listedUBUNTU-CVE-2020-11998
Ubuntu:26.10activemqno fix listedUBUNTU-CVE-2020-11998

Affected products (as reported)

VendorProductVersions
n/a Apache ActiveMQ Apache Tomcat 5.15.12

References