Read the docs
TI-2024-21191 Aliases CVE-2024-32114GHSA-gj5m-m88j-v7c3

Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

Priority MEDIUM 50CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">   <property name="constraint" ref="securityConstraint" />   <property name="pathSpec" value="/" /> </bean> Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07148 94th percentileScored 2026-11-07
Fix Fixed org.apache.activemq:apache-activemq (Maven): 6.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache ActiveMQ6.0.0 – 6.1.1—No fix listedCNA
—org.apache.activemq:apache-activemq (Maven)6.0.0 to before 6.1.26.1.2Patch availableGHSA-gj5m-m88j-v7c3
  • Apache ActiveMQ VendorApache Affected 6.0.0 – 6.1.1 Fixed in — No fix listed CNA
  • org.apache.activemq:apache-activemq (Maven) Vendor— Affected 6.0.0 to before 6.1.2 Fixed in 6.1.2 Patch available GHSA-gj5m-m88j-v7c3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*6.0.0 to before 6.1.2VulnerableApache
  • cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.1.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-gj5m-m88j-v7c3 org.apache.activemq:apache-activemq (Maven) Fixed in 6.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 12 products
  • A-MQ Clients 2
  • Red Hat AMQ Broker 7
  • Red Hat AMQ Clients
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of Apache Camel for Spring Boot 3
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32114
  2. 2026-10-03 Alias added: GHSA-gj5m-m88j-v7c3

References

Advisory 2

Other 4

  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
  • TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
  • TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
  • TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
  • TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences