Read the docs
TI-2022-20072 Aliases CVE-2022-41678GHSA-53v4-42fg-g287

Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

Priority HIGH 80CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287 and CWE-502.

Summary

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

Why it matters now

EPSS 0.85694 99th percentileScored 2026-11-07
Fix Partial Apache ActiveMQ (Apache Software Foundation): 5.16.6, 5.17.4, 5.18.0 +1org.apache.activemq:apache-activemq (Maven): 5.16.6, 5.17.4Red Hat: 3 advisoriesRed Hat: 3 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache ActiveMQbefore 5.16.6; 5.17.0 to before 5.17.45.16.6, 5.17.4, 5.18.0, 6.0.0Patch availableCNA
—org.apache.activemq:apache-activemq (Maven)before 5.16.65.16.6Patch availableGHSA-53v4-42fg-g287
—org.apache.activemq:apache-activemq (Maven)5.17.0 to before 5.17.45.17.4Patch availableGHSA-53v4-42fg-g287
  • Apache ActiveMQ VendorApache Affected before 5.16.6; 5.17.0 to before 5.17.4 Fixed in 5.16.6, 5.17.4, 5.18.0, 6.0.0 Patch available CNA
  • org.apache.activemq:apache-activemq (Maven) Vendor— Affected before 5.16.6 Fixed in 5.16.6 Patch available GHSA-53v4-42fg-g287
  • org.apache.activemq:apache-activemq (Maven) Vendor— Affected 5.17.0 to before 5.17.4 Fixed in 5.17.4 Patch available GHSA-53v4-42fg-g287

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*before 5.16.6; 5.17.0 to before 5.17.4VulnerableApache
  • cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions before 5.16.6; 5.17.0 to before 5.17.4 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache ActiveMQ (Apache Software Foundation) Fixed in 5.16.6, 5.17.4, 5.18.0, 6.0.0
  • Fix · GHSA-53v4-42fg-g287 org.apache.activemq:apache-activemq (Maven) Fixed in 5.16.6 Advisory →
  • Fix · GHSA-53v4-42fg-g287 org.apache.activemq:apache-activemq (Maven) Fixed in 5.17.4 Advisory →

Red Hat 3 advisories

  • RHSA-2024:3354 Released 2024-05-23 · Red Hat rating Important
    Red Hat Fuse 7.13.0 release and security update
    • Red Hat Fuse 7.13.0
  • RHSA-2024:2945 Released 2024-05-21 · Red Hat rating Important
    Red Hat AMQ Broker 7.12.0 release and security update
    • Red Hat AMQ Broker 7
  • RHSA-2024:2944 Released 2024-05-21 · Red Hat rating Important
    AMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
    • Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Middleware Containers for OpenShiftFixed RHSA-2024:2944
Red Hat AMQ Broker 7Fixed RHSA-2024:2945
Red Hat Fuse 7.13.0Fixed RHSA-2024:3354
Not affected: 9 products
  • A-MQ Clients 2
  • Middleware Containers for OpenShift
  • Red Hat Data Grid 8
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of OptaPlanner 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41678
  2. 2026-10-03 Alias added: GHSA-53v4-42fg-g287

References

Advisory 3

Other 11

  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
  • TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
  • TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
  • TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
  • TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences