4

CVE-2015-7559

It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Activemq Version < 5.14.5
Apache ≫ Activemq Version >= 5.15.0 < 5.15.5
Redhat ≫ Jboss A-mq Version6.2.1
Redhat ≫ Jboss A-mq Version6.3
Redhat ≫ Jboss Fuse Version6.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.258
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:N/A:P
secalert@redhat.com 2.7 1.2 1.4
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559
Patch
Third Party Advisory
Issue Tracking