CVE-2012-6551: Apache ActiveMQ default configuration subject to denial of service
Summary
CVE-2012-6551: Apache ActiveMQ default configuration subject to denial of service. Affects org.apache.activemq:apache-activemq versions < 5.8.0. Fixed in 5.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that provides reliable messaging between distributed applications. It supports multiple protocols and messaging patterns, making it a popular choice for enterprise messaging systems. The default configuration of Apache ActiveMQ before version 5.8.0 includes a sample web application, which can be accessed remotely via HTTP requests. This default configuration introduces a vulnerability that can be exploited by remote attackers to cause a denial of service. By sending a large number of HTTP requests, an attacker can consume significant broker resources, leading to service degradation or unavailability.
Vulnerability Detail
The vulnerability in Apache ActiveMQ arises from the default configuration that enables the sample web application. This allows remote attackers to launch a denial of service attack by sending HTTP requests. The attack can result in the consumption of broker resources, leading to service disruption. The vulnerability is classified as moderate in severity and has been assigned the CVE identifier CVE-2012-6551. It was first published on May 17, 2022, and the National Vulnerability Database (NVD) published it on April 21, 2013. The Common Weakness Enumeration (CWE) identifier for this vulnerability is CWE-400.
How To Fix
Minimum fixed version
5.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 5.8.0 or later is not immediately feasible, a temporary workaround is to manually disable the sample web application in the Apache ActiveMQ configuration. This can be done by modifying the configuration file to comment out or remove the relevant configuration entries. However, it is strongly advised to upgrade to the latest version as soon as possible to fully mitigate the vulnerability.
Conclusion
The default configuration of Apache ActiveMQ before version 5.8.0 includes a sample web application that can be exploited by remote attackers to launch a denial of service attack. Upgrading to version 5.8.0 or later is the recommended solution to fix this vulnerability. Alternatively, a temporary workaround is available by manually disabling the sample web application in the configuration. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:apache-activemq →
FAQ
Apache ActiveMQ is an open-source message broker that facilitates reliable messaging between distributed applications. It supports various protocols and messaging patterns, making it suitable for enterprise messaging systems.
The vulnerability allows remote attackers to launch a denial of service attack by consuming broker resources through HTTP requests. This can result in service degradation or unavailability.
To fix this vulnerability, it is recommended to upgrade Apache ActiveMQ to version 5.8.0 or later. This version disables the sample web application by default, mitigating the risk of a denial of service attack.
A temporary workaround is to manually disable the sample web application in the Apache ActiveMQ configuration. However, it is strongly advised to upgrade to the latest version as soon as possible.
The vulnerability is classified as moderate in severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:apache-activemq.
