Read the docs
TI-2020-11190 Aliases CVE-2020-14319GHSA-73hh-256q-9c49

Cross-site request forgery in AMQ-Online and EnMasse

Priority LOW 26CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-352.

Summary

It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not instigated or bypassed. For example authorised users using an older browser with Adobe Flash are vulnerable when targeted by an attacker. This flaw affects all versions of AMQ-Online prior to 1.5.2 and Enmasse versions 0.31.0-rc1 up until but not including 0.32.2.

Why it matters now

EPSS 0.00321 25th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—AMQ-Online and EnMasseAMQ-Online prior to 1.5.2 and Enmasse versions 0.31.0-rc1 up until but not including 0.32.2—No fix listedCNA
  • AMQ-Online and EnMasse Vendor— Affected AMQ-Online prior to 1.5.2 and Enmasse versions 0.31.0-rc1 up until but not including 0.32.2 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:amq_online:*:*:*:*:*:*:*:*before 1.5.2VulnerableRed Hat
cpe:2.3:a:redhat:enmasse:*:*:*:*:*:*:*:*before 0.32.2VulnerableRed Hat
  • cpe:2.3:a:redhat:amq_online:*:*:*:*:*:*:*:* Versions before 1.5.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:enmasse:*:*:*:*:*:*:*:* Versions before 0.32.2 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2020:3209 Released 2020-07-29 · Red Hat rating Moderate
    AMQ Online 1.5.2 release and security update
    • Red Hat AMQ Online 1.5.2 GA

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Online 1.5.2 GAFixed RHSA-2020:3209

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14319
  2. 2026-10-03 Alias added: GHSA-73hh-256q-9c49

References

Advisory 1

  • TI-2022-01162 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and… CVSS 3.1HIGH 7.5
  • TI-2020-11219 Improper check for unusual conditions in AMQ CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences