| Vulnerability Name: | CVE-2015-1830 (CCN-105644) | ||||||||||||
| Assigned: | 2015-08-17 | ||||||||||||
| Published: | 2015-08-17 | ||||||||||||
| Updated: | 2023-02-13 | ||||||||||||
| Summary: | Apache ActiveMQ could allow a remote attacker to traverse directories on the system, caused by an error in the fileserver upload/download functionality. By placing a jsp file in the admin console, an attacker could exploit this vulnerability to execute arbitrary shell commands on the system. | ||||||||||||
| CVSS v3 Severity: | 9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 9.1 Critical (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
| ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: CCN Type: Apache Web site CVE-2015-1830 - Path traversal leading to unauthenticated RCE in ActiveMQ Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: MITRE Type: CNA CVE-2015-1830 Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: CCN Type: oss-security Mailing List, Mon, 17 Aug 2015 14:29:05 +0200 [ANNOUNCE] CVE-2015-1830 - Path traversal leading to unauthenticated RCE in ActiveMQ Source: CCN Type: BID-76452 Apache ActiveMQ CVE-2015-1830 Directory Traversal Vulnerability Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: XF Type: UNKNOWN apache-activemq-cve20151830-dir-trav(105644) Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: CCN Type: Packet Storm Security [12-03-2016] Apache ActiveMQ 5.11.1 / 5.13.2 Directory Traversal / Command Execution Source: CCN Type: Packet Storm Security [03-05-2020] Apache ActiveMQ 5.11.1 Directory Traversal / Shell Upload Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [03-09-2020] Source: CCN Type: IBM Security Bulletin 0872142 (Security Identity Governance and Intelligence) IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities Source: CCN Type: IBM Security Bulletin 6955033 (Security Directory Integrator) IBM Security Directory Integrator is affected by multiple security vulnerabilities Source: CCN Type: IBM Security Bulletin 7001693 (Security Directory Suite VA) IBM Security Directory Suite is vulnerable to multiple issues Source: CCN Type: WhiteSource Vulnerability Database CVE-2015-1830 Source: CCN Type: ZDI-15-407 Apache ActiveMQ RestFilter Directory Traversal Remote Code Execution Vulnerability | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||