Risk Letters

Exploited vulnerability

CVE-2016-3088

TLP:CLEAR

Apache ActiveMQ Improper Input Validation Vulnerability

The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

Facts

  • Vendor: Apache
  • Product: ActiveMQ
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 98.5 %
  • On CISA's Known Exploited Vulnerabilities list since: 10 February 2022
  • First known exploitation: 10 February 2022
  • CISA's deadline for US federal agencies: 10 August 2022
  • Weakness: CWE-20
  • First seen by Risk Letters: 10 February 2022

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD