Lucene search

[email protected]NVD:CVE-2021-26118

HistoryJan 27, 2021 - 7:15 p.m.

CVE-2021-26118

2021-01-2719:15:13

CWE-284

[email protected]

web.nvd.nist.gov

apache

activemq

artemis

advisory messages

access control

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

50.5%

JSON

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

Affected configurations

Nvd

Node

apacheactivemq_artemisMatch2.15.0

Node

netapponcommand_workflow_automationMatch-

VendorProductVersionCPE
apacheactivemq_artemis2.15.0cpe:2.3:a:apache:activemq_artemis:2.15.0:*:*:*:*:*:*:*
netapponcommand_workflow_automation-cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	activemq_artemis	2.15.0	cpe:2.3:a:apache:activemq_artemis:2.15.0:::::::*
netapp	oncommand_workflow_automation	-	cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*