CVE-2013-3060: Improper Authentication in Apache ActiveMQ
Summary
CVE-2013-3060: Improper Authentication in Apache ActiveMQ. Affects org.apache.activemq:activemq-client versions < 5.8.0. Fixed in 5.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that provides reliable messaging between distributed applications. It is widely used in enterprise systems for its support of the Java Message Service (JMS) API. The web console in Apache ActiveMQ versions prior to 5.8.0 does not enforce authentication, allowing unauthorized access to sensitive information and potentially leading to denial of service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2013-3060, arises from the lack of authentication enforcement in the web console of Apache ActiveMQ. This allows remote attackers to exploit the system by sending HTTP requests without the need for valid credentials. The consequences of this vulnerability include unauthorized access to sensitive information and the potential for denial of service attacks.
How To Fix
Latest published version: 6.3.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can disable or restrict access to the web console by modifying the configuration settings of Apache ActiveMQ. This can be achieved by modifying the 'jetty.xml' file to enable authentication and restrict access to authorized users only. Below is an example of the configuration changes:
<bean id="securityConstraint" class="org.eclipse.jetty.util.security.Constraint">
<property name="name" value="BASIC" />
<property name="roles" value="user,admin" />
<property name="authenticate" value="true" />
By making these changes, the web console will require valid credentials for access, mitigating the vulnerability.
Conclusion
In conclusion, CVE-2013-3060 is an improper authentication vulnerability in Apache ActiveMQ versions prior to 5.8.0. It allows remote attackers to access sensitive information and potentially launch denial of service attacks. To mitigate this vulnerability, it is recommended to upgrade to Apache ActiveMQ 5.8.0 or later. Alternatively, users can apply the provided workaround to restrict access to the web console. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-client →
FAQ
Apache ActiveMQ is an open-source message broker that facilitates reliable messaging between distributed applications. It supports the Java Message Service (JMS) API and is widely used in enterprise systems.
The vulnerability allows remote attackers to access sensitive information and potentially launch denial of service attacks on Apache ActiveMQ installations.
To fix this vulnerability, it is recommended to upgrade to Apache ActiveMQ version 5.8.0 or later, which includes authentication mechanisms to prevent unauthorized access.
Yes, users can disable or restrict access to the web console by modifying the configuration settings of Apache ActiveMQ. This involves enabling authentication and restricting access to authorized users only.
For more information about this vulnerability, you can refer to the CVE-2013-3060 entry or consult the Apache ActiveMQ documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-client.
