CVE-2024-32114
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
02/05/2024
Last modified:
11/02/2025
Description
In Apache ActiveMQ 6.x, the default configuration doesn&#39;t secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).<br />
It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).<br />
<br />
To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:<br />
<br />
<br />
<br />
<br />
<br />
Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.<br />
Impact
Base Score 3.x
8.50
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* | 6.0.0 (including) | 6.1.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page