Information disclosure in Apache ActiveMQ
Priority LOW 38CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.
Why it matters now
EPSS 0.22776 97th percentileScored 2026-11-07
Fix Partial org.apache.activemq:activemq-openwire-generator (Maven): 5.15.3org.apache.activemq:activemq-parent (Maven): 5.15.3, 5.14.6Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ActiveMQ | Apache ActiveMQ 5.14.0 to 5.15.2 | — | No fix listed | CNA |
| — | org.apache.activemq:activemq-openwire-generator (Maven) | 5.14.0 to before 5.15.3 | 5.15.3 | Patch available | GHSA-7qm4-p377-fr2r |
| — | org.apache.activemq:activemq-parent (Maven) | 5.15.0 to before 5.15.3 | 5.15.3 | Patch available | GHSA-7qm4-p377-fr2r |
| — | org.apache.activemq:activemq-parent (Maven) | 5.14.0 to before 5.14.6 | 5.14.6 | Patch available | GHSA-7qm4-p377-fr2r |
- Apache ActiveMQ VendorApache Affected Apache ActiveMQ 5.14.0 to 5.15.2 Fixed in — No fix listed CNA
- org.apache.activemq:activemq-openwire-generator (Maven) Vendor— Affected 5.14.0 to before 5.15.3 Fixed in 5.15.3 Patch available GHSA-7qm4-p377-fr2r
- org.apache.activemq:activemq-parent (Maven) Vendor— Affected 5.15.0 to before 5.15.3 Fixed in 5.15.3 Patch available GHSA-7qm4-p377-fr2r
- org.apache.activemq:activemq-parent (Maven) Vendor— Affected 5.14.0 to before 5.14.6 Fixed in 5.14.6 Patch available GHSA-7qm4-p377-fr2r
Remediation
- Fix · GHSA-7qm4-p377-fr2r org.apache.activemq:activemq-openwire-generator (Maven) Fixed in 5.15.3 Advisory →
- Fix · GHSA-7qm4-p377-fr2r org.apache.activemq:activemq-parent (Maven) Fixed in 5.15.3 Advisory →
- Fix · GHSA-7qm4-p377-fr2r org.apache.activemq:activemq-parent (Maven) Fixed in 5.14.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
Not affected: 1 product
- Red Hat JBoss Fuse 6
Timeline
- 2026-10-02 Threatist record created from CVE-2017-15709
- 2026-10-03 Alias added: GHSA-7qm4-p377-fr2r
References
Other 19
- https://lists.apache.org/thread.html/2b6f04a552c6ec2de6563c2df3bba813f0fe9c7e22cce27b7829db89%40%3Cdev.activemq.apache.org%3E
- [activemq-commits] 20190327 [CONF] Apache ActiveMQ > Security Advisories
- [activemq-dev] 20190327 Re: Website
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/
- [activemq-dev] 20190328 Re: Website
- [activemq-gitbox] 20191021 [GitHub] [activemq-website] clebertsuconic commented on a change in pull request #17: Fix the ordering in the security advisories page
- [activemq-gitbox] 20191022 [GitHub] [activemq-website] coheigea commented on a change in pull request #17: Fix the ordering in the security advisories page
- [debian-lts-announce] 20210305 [SECURITY] [DLA 2583-1] activemq security update
- https://github.com/apache/activemq/commit/8ff18c5e254bf43395f2e0d7e3a1092b33ec646
- https://github.com/apache/activemq/commit/d2e49be3a8f21d862726c1f6bc9e1caa6ee8b58
- https://github.com/apache/activemq
- https://issues.apache.org/jira/browse/AMQ-6871
- https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1@%3Cdev.activemq.apache.org%3E
- https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/2b6f04a552c6ec2de6563c2df3bba813f0fe9c7e22cce27b7829db89@%3Cdev.activemq.apache.org%3E
- https://lists.apache.org/thread.html/3f1e41bc9153936e065ca3094bd89ff8167ad2d39ac0b410f24382d2@%3Cgitbox.activemq.apache.org%3E
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/c0ec53b72b3240b187afb1cf67e4309a9e5f607282010aa196734814@%3Cgitbox.activemq.apache.org%3E
- https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b@%3Cdev.activemq.apache.org%3E
More Apache Activemq vulnerabilities
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-15709 · CVE Program
- CVE-2017-15709 · NVD
- FIRST EPSS
- GHSA-7qm4-p377-fr2r · GitHub Advisory Database · CC BY 4.0
- CVE-2017-15709 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences