CVE-2016-3088
Critical · 9.8 CISA KEVCVSS
9.8
EPSS
98.5%
Published
Jun 1, 2016
CISA due date
Aug 10, 2022
The record
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.activemq:activemq-client | 5.0.0 | 5.14.0 |
| Debian:11 | activemq | 0 | 5.14.0+dfsg-1 |
| Debian:12 | activemq | 0 | 5.14.0+dfsg-1 |
| Debian:13 | activemq | 0 | 5.14.0+dfsg-1 |
| Ubuntu:Pro:16.04:LTS | activemq | 0 | No fix |
| maven | org.apache.activemq/activemq-client | 5.0.0 | 5.14.0 |
Related vulnerabilities
- CVE-2015-7559 It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown… Also affects org.apache.activemq:activemq-client
- CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in… Also affects org.apache.activemq:activemq-client
- CVE-2015-1830 Directory traversal vulnerability in the fileserver upload/download functionality for… Also affects org.apache.activemq:activemq-client
- CVE-2014-3576 The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ… Also affects org.apache.activemq:activemq-client
- CVE-2021-26117 The optional ActiveMQ LDAP login module can be configured to use anonymous access to the… Also affects activemq
- CVE-2022-35278 In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content… Also affects activemq
- CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
- CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434