CVE-2016-3088

critical-risk
Published 2016-06-01

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Do I need to act?

!
94.3% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
2 public exploits available
42283, 40857
+
Fix available
Upgrade to: 71cbc652835e8b6b9d17b7a28fc998fce4840a9b
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Apache

References (19)

Vendor Advisory http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.t...
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-2036.html
Broken Link http://www.securitytracker.com/id/1035951
Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-16-356
Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-16-357
Mailing List https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65...
Issue Tracking https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861...
Mailing List https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0...
Exploit https://www.exploit-db.com/exploits/42283/
Vendor Advisory http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.t...
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-2036.html
Broken Link http://www.securitytracker.com/id/1035951
Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-16-356
Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-16-357
Mailing List https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65...
Issue Tracking https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861...
Mailing List https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0...
Exploit https://www.exploit-db.com/exploits/42283/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-...
71
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 34/34 · Critical
Exposure 5/34 · Minimal