Red Hat JBoss A-Mq vulnerabilities

17 CVEs affecting Red Hat JBoss A-Mq, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-44487, published 2023-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2015-7501, published 2017-11-09. Critical severity, CVSS 9.8. EPSS: 85.6% chance of exploitation in the next 30 days. Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2015-5183, published 2017-09-25. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
CVE-2013-4372, published 2013-09-30. Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject…
CVE-2016-8648, published 2018-08-01. High severity, CVSS 7.2. EPSS: 2% chance of exploitation in the next 30 days. It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute…
CVE-2015-7559, published 2019-08-01. Low severity, CVSS 2.7. EPSS: 2% chance of exploitation in the next 30 days. It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to…
CVE-2016-8653, published 2018-08-01. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.
CVE-2022-1278, published 2022-09-13. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVE-2015-5181, published 2017-09-25. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.

Latest

CVE-2023-4066, published 2023-09-27. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in…
CVE-2023-4065, published 2023-09-27. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local…
CVE-2023-1664, published 2023-05-26. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak.…
CVE-2020-14379, published 2022-08-16. Medium severity, CVSS 5.6. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information disclosure.
CVE-2021-3425, published 2021-06-01. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions…
CVE-2021-3536, published 2021-05-20. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This…