Red Hat Security AdvisoryRHSA-2020:4154
Red Hat AMQ Broker 7.4.5 release and security update
Released 2020-10-01 · Red Hat rating Moderate · View on Red Hat →
Fixes 3 records
Priority MEDIUM 64
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.26803 · Published 2019-07-03 · Partial fix · 2.5.0 CWE-918
Priority MEDIUM 46
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.1133 · Published 2021-01-27 · Fixed in 2.16.0, 5.16.1 +1 CWE-287
Priority LOW 37
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02204 · Published 2017-09-25 · Partial fix
