CVE-2010-1587: Apache ActiveMQ Sensitive Information Disclosure via the Jetty ResourceHandler
Summary
CVE-2010-1587: Apache ActiveMQ Sensitive Information Disclosure via the Jetty ResourceHandler. Affects org.apache.activemq:activemq-web-console versions >= 5.0.0, < 5.3.2. Fixed in 5.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that implements the Java Message Service (JMS) protocol. It provides reliable messaging between distributed applications and supports various messaging patterns. The ActiveMQ Web Console is a web-based administration tool that allows users to manage and monitor ActiveMQ instances. The Jetty ResourceHandler is a component used by the ActiveMQ Web Console to serve static resources such as HTML, CSS, and JavaScript files. However, prior to version 5.3.2, a vulnerability exists in the Jetty ResourceHandler that allows remote attackers to read JSP source code by exploiting a specific URI pattern in the admin/index.jsp, admin/queues.jsp, or admin/topics.jsp endpoints.
Vulnerability Detail
The vulnerability (CVE-2010-1587) in Apache ActiveMQ allows remote attackers to read JSP source code by sending a request with a URI that starts with a '//' (slash slash) substring. This can be achieved by appending the '//' substring to the admin/index.jsp, admin/queues.jsp, or admin/topics.jsp endpoints. By exploiting this vulnerability, an attacker can gain access to sensitive information, including the source code of JSP files, which may contain sensitive data or expose internal implementation details. This information disclosure can potentially lead to further attacks or unauthorized access to the system.
How To Fix
Latest published version: 6.3.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Apache ActiveMQ is not immediately feasible, a temporary workaround can be implemented by modifying the affected JSP files. The workaround involves removing or obfuscating any sensitive information present in the JSP source code. Additionally, access controls can be enforced at the network level to restrict access to the affected endpoints, limiting the exposure of the vulnerability.
Conclusion
The Jetty ResourceHandler vulnerability in Apache ActiveMQ exposes sensitive information and can potentially lead to further attacks or unauthorized access. It is crucial to upgrade to the latest version of Apache ActiveMQ (5.3.2 or later) to mitigate this vulnerability. If immediate upgrade is not feasible, implementing the suggested workaround and enforcing access controls can help reduce the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-web-console →
FAQ
Apache ActiveMQ is an open-source message broker that implements the Java Message Service (JMS) protocol. It provides reliable messaging between distributed applications and supports various messaging patterns.
The ActiveMQ Web Console is a web-based administration tool that allows users to manage and monitor ActiveMQ instances. It provides a graphical interface for configuring and monitoring message queues and topics.
The Jetty ResourceHandler vulnerability in Apache ActiveMQ allows remote attackers to read JSP source code by exploiting a specific URI pattern in the admin/index.jsp, admin/queues.jsp, or admin/topics.jsp endpoints. By appending a '//' substring to the URI, an attacker can bypass access restrictions and gain access to sensitive information.
The vulnerability allows attackers to read JSP source code, which may contain sensitive information or expose internal implementation details. This information disclosure can potentially lead to further attacks, such as identifying additional vulnerabilities or unauthorized access to the system.
The recommended mitigation is to upgrade to Apache ActiveMQ version 5.3.2 or later, which includes a fix for the Jetty ResourceHandler vulnerability. If immediate upgrade is not possible, a temporary workaround involves modifying the affected JSP files to remove or obfuscate sensitive information and enforcing access controls at the network level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-web-console.
