CVE-2021-26118

 

Published at: - 27-01-2021 08:15

Last modified: - 01-08-2022 02:37

Total changes: - 8

Description

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3E
• [announce] 20210127 CVE-2021-26118: Flaw in ActiveMQ Artemis OpenWire support-Mailing List, Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210827-0002/

 

Keywords

NVD

 

CVE-2021-26118

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures