Missing authentication in Apache ActiveMQ
Priority LOW 34CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 3 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-306.
Summary
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
Why it matters now
EPSS 0.04544 91st percentileScored 2026-11-07
Fix Partial org.apache.activemq:activemq-parent (Maven): 5.15.12Red Hat: 3 advisoriesRed Hat: 3 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache ActiveMQ | Apache ActiveMQ version prior to 5.15.12 | — | No fix listed | CNA |
| — | org.apache.activemq:activemq-parent (Maven) | before 5.15.12 | 5.15.12 | Patch available | GHSA-xgrx-xpv2-6vp4 |
- Apache ActiveMQ Vendor— Affected Apache ActiveMQ version prior to 5.15.12 Fixed in — No fix listed CNA
- org.apache.activemq:activemq-parent (Maven) Vendor— Affected before 5.15.12 Fixed in 5.15.12 Patch available GHSA-xgrx-xpv2-6vp4
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* | before 5.15.12 | Vulnerable | Apache |
| cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* | 8.0.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions before 5.15.12 Vulnerable ·Apache
- cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-xgrx-xpv2-6vp4 org.apache.activemq:activemq-parent (Maven) Fixed in 5.15.12 Advisory →
Red Hat 3 advisories
- RHSA-2021:3207 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel Quarkus Tech-Preview 2 security update
- Red Hat Integration Camel Quarkus 2
- RHSA-2021:3205 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel-K 1.4 release and security update
- Red Hat Integration
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
| Red Hat Integration | Fixed | RHSA-2021:3205 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:3207 |
Not affected: 7 products
- Red Hat AMQ Broker 7
- Red Hat Decision Manager 7
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13920
- 2026-10-03 Alias added: GHSA-xgrx-xpv2-6vp4
References
Advisory 4
Other 11
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26117
- [activemq-commits] 20210208 [activemq-website] branch master updated: Publish CVE-2020-13947
- [debian-lts-announce] 20231120 [SECURITY] [DLA 3657-1] activemq security update
- https://github.com/apache/activemq/commit/359ae4b
- https://github.com/apache/activemq/commit/48cd61d
- https://github.com/apache/activemq/commit/58382283330f7c7b110c7afd8ef4ca2648786532
- https://github.com/apache/activemq/commit/b7dca5e
- https://github.com/apache/activemq
- https://issues.apache.org/jira/browse/AMQ-7400
- https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3E
Sources
- CVE-2020-13920 · CVE Program
- CVE-2020-13920 · NVD
- FIRST EPSS
- GHSA-xgrx-xpv2-6vp4 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-13920 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences