Activemq Artemis vulnerabilitiesRanked by how likely they are to be used.
Activemq Artemis is made by Apache. We track 10 published vulnerabilities in it, across 66 versions. None of them is on the list of flaws known to be exploited today. If you run Activemq Artemis, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Activemq Artemis vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Activemq Artemis's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Activemq Artemis flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 17%CVE-2023-50780High
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint.
- 11%CVE-2021-26117High
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server.
- 6.9%CVE-2016-4978High
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users...
- 6.0%CVE-2017-12174High
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message.
- 4.3%CVE-2020-13932Medium
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability.
- 3.8%CVE-2021-26118High
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session.
- 3.1%CVE-2021-4040Medium
A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition.
- 2.7%CVE-2022-23913High
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
- 1.7%CVE-2022-35278Medium
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
- 0.7%CVE-2020-10727Medium
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when...
Running Activemq Artemis? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
- Matched to
- Activemq Artemis on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 10 published vulnerabilities listed under the name Activemq Artemis, across 66 versions.
None of Activemq Artemis's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Activemq Artemis. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.