PUBLISHED
2026-06-01 09:16
MODIFIED
2026-06-01 09:16
EPSS (Prob. Exploit)
0.44%
Top 61.8%
> DESCRIPTION
Incorrect Default Permissions vulnerability in Apache ActiveMQ.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.
Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-276: Incorrect Default Permissions - During installation, installed file permissions are set to allow anyone to modify those files.
> GITHUB SECURITY ADVISORY
GHSA-99qx-5qqr-4j95
HIGH
Apache ActiveMQ has an Incorrect Default Permissions vulnerability
AFFECTED PACKAGES:
MAVEN / org.apache.activemq:apache-activemq
>= 6.0.0, < 6.2.6
Fixed in: 6.2.6
MAVEN / org.apache.activemq:apache-activemq
< 5.19.7
Fixed in: 5.19.7
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default
AFFECTED PACKAGES:
Unknown / Unknown
24 versions affected
ALIASES:
BIT-activemq-2026-49157, GHSA-99qx-5qqr-4j95
> HISTORIQUE DES MODIFICATIONS
Première apparition
01/06/2026 09:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-276: Incorrect Default Permissions - During installation, installed file permissions are set to allow anyone to modify those files.
Total des modifications: 1
Dernière mise à jour: 4 months ago