Read the docs
TI-2020-11219 Aliases CVE-2020-14348GHSA-hxj4-cvx4-5vg6

Improper check for unusual conditions in AMQ

Priority LOW 22CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-248.

Summary

It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts AMQ Online in an inconsistent state, where the AMQ Online components do not operate properly, such as the failure of provisioning and the failure of creating addresses, though this does not impact upon already existing messaging clients or brokers.

Why it matters now

EPSS 0.00808 57th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—AMQAMQ Online before 1.5.2—No fix listedCNA
  • AMQ Vendor— Affected AMQ Online before 1.5.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:amq_online:*:*:*:*:*:*:*:*before 1.5.2VulnerableRed Hat
  • cpe:2.3:a:redhat:amq_online:*:*:*:*:*:*:*:* Versions before 1.5.2 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2020:3209 Released 2020-07-29 · Red Hat rating Moderate
    AMQ Online 1.5.2 release and security update
    • Red Hat AMQ Online 1.5.2 GA

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat A-MQ OnlineAffectedNo fix yet
Red Hat AMQ Online 1.5.2 GAFixed RHSA-2020:3209

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14348
  2. 2026-10-03 Alias added: GHSA-hxj4-cvx4-5vg6

References

Other 1

  • TI-2022-01162 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and… CVSS 3.1HIGH 7.5
  • TI-2020-11190 Cross-site request forgery in AMQ-Online and EnMasse CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences