Apache Software Foundation ActiveMQ 5.15.12

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:activemq:5.15.12:*:*:*:*:*:*:*

part: a version: 5.15.12 update: *

VendorApache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95)
ProductActivemq (db75e7d1-71e2-5c1b-8c68-2b326744850c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:apache/activemq purl2cpe 2026-06-01 10:14:26.244489
pkg:deb/debian/activemq purl2cpe 2026-06-01 10:14:26.244490
pkg:deb/ubuntu/activemq purl2cpe 2026-06-01 10:14:26.244491
pkg:dokcer/pharmazon/activemq_artemis purl2cpe 2026-06-01 10:14:26.244493
pkg:github/apache/activemq purl2cpe 2026-06-01 10:14:26.244494
pkg:maven/org.apache.activemq/activemq purl2cpe 2026-06-01 10:14:26.244495
pkg:maven/org.apache.activemq/activemq-core purl2cpe 2026-06-01 10:14:26.244497

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-11998 vulnerable 2026-06-08 05:17:56.116327 Details available
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
Published: 2020-09-10T18:10:22.000Z
Updated: 2024-08-04T11:48:57.796Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.