Read the docs
TI-2010-01199 Aliases CVE-2010-1244GHSA-33j4-8vcr-f79v

Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache…

Priority LOW 32CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Tampering
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.

Why it matters now

EPSS 0.01075 65th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed org.apache.activemq:activemq-parent (Maven): 5.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.activemq:activemq-parent (Maven)before 5.3.15.3.1Patch availableGHSA-33j4-8vcr-f79v
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.activemq:activemq-parent (Maven) Vendor— Affected before 5.3.1 Fixed in 5.3.1 Patch available GHSA-33j4-8vcr-f79v

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*up to 5.3.0VulnerableApache
cpe:2.3:a:apache:activemq:1.1:*:*:*:*:*:*:*1.1VulnerableApache
cpe:2.3:a:apache:activemq:1.2:*:*:*:*:*:*:*1.2VulnerableApache
cpe:2.3:a:apache:activemq:1.3:*:*:*:*:*:*:*1.3VulnerableApache
cpe:2.3:a:apache:activemq:1.4:*:*:*:*:*:*:*1.4VulnerableApache
cpe:2.3:a:apache:activemq:1.5:*:*:*:*:*:*:*1.5VulnerableApache
cpe:2.3:a:apache:activemq:2.0:*:*:*:*:*:*:*2.0VulnerableApache
cpe:2.3:a:apache:activemq:2.1:*:*:*:*:*:*:*2.1VulnerableApache
cpe:2.3:a:apache:activemq:3.0:*:*:*:*:*:*:*3.0VulnerableApache
cpe:2.3:a:apache:activemq:3.1:*:*:*:*:*:*:*3.1VulnerableApache
  • cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions up to 5.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Apache
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:3.2:*:*:*:*:*:*:*3.2VulnerableApache
cpe:2.3:a:apache:activemq:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableApache
cpe:2.3:a:apache:activemq:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableApache
cpe:2.3:a:apache:activemq:4.0:*:*:*:*:*:*:*4.0VulnerableApache
cpe:2.3:a:apache:activemq:4.0:m4:*:*:*:*:*:*4.0 m4VulnerableApache
cpe:2.3:a:apache:activemq:4.0:rc2:*:*:*:*:*:*4.0 rc2VulnerableApache
cpe:2.3:a:apache:activemq:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableApache
cpe:2.3:a:apache:activemq:4.0.2:*:*:*:*:*:*:*4.0.2VulnerableApache
cpe:2.3:a:apache:activemq:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableApache
cpe:2.3:a:apache:activemq:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableApache
cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableApache
cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableApache
cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableApache
  • cpe:2.3:a:apache:activemq:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:4.0:m4:*:*:*:*:*:* Versions 4.0 m4 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:4.0:rc2:*:*:*:*:*:* Versions 4.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-33j4-8vcr-f79v org.apache.activemq:activemq-parent (Maven) Fixed in 5.3.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-1244
  2. 2026-10-03 Alias added: GHSA-33j4-8vcr-f79v

References

Exploit 2

Patch 1

Advisory 1

Other 3

  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
  • TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
  • TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
  • TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
  • TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences