Read the docs
TI-2015-01643 Aliases CVE-2015-1830GHSA-3v63-f83x-37x4

Directory traversal vulnerability in the fileserver upload/download functionality for…

Priority MEDIUM 64CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

Why it matters now

EPSS 0.84408 99th percentileScored 2026-11-07
Fix Fixed org.apache.activemq:activemq-client (Maven): 5.11.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.activemq:activemq-client (Maven)5.0.0 to before 5.11.25.11.2Patch availableGHSA-3v63-f83x-37x4
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.activemq:activemq-client (Maven) Vendor— Affected 5.0.0 to before 5.11.2 Fixed in 5.11.2 Patch available GHSA-3v63-f83x-37x4

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableApache
cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableApache
cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableApache
cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*5.3.0VulnerableApache
cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*5.3.1VulnerableApache
cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*5.3.2VulnerableApache
cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*5.4.0VulnerableApache
cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*5.4.1VulnerableApache
cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*5.4.2VulnerableApache
cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*5.4.3VulnerableApache
  • cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:* Versions 5.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:* Versions 5.3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:* Versions 5.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:* Versions 5.4.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:* Versions 5.4.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:* Versions 5.4.3 Vulnerable ·Apache
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableApache
cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*5.5.1VulnerableApache
cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*5.6.0VulnerableApache
cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*5.7.0VulnerableApache
cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*5.8.0VulnerableApache
cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*5.9.0VulnerableApache
cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*5.9.1VulnerableApache
cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableApache
cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:*5.10.1VulnerableApache
cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:*5.10.2VulnerableApache
cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:*5.11.0VulnerableApache
cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:*5.11.1VulnerableApache
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
  • cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:* Versions 5.9.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:* Versions 5.10.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:* Versions 5.10.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:* Versions 5.11.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:* Versions 5.11.1 Vulnerable ·Apache
  • cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft

Remediation

  • Fix · GHSA-3v63-f83x-37x4 org.apache.activemq:activemq-client (Maven) Fixed in 5.11.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-1830
  2. 2026-10-03 Alias added: GHSA-3v63-f83x-37x4

References

Advisory 1

Other 10

  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
  • TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
  • TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
  • TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
  • TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences