Vulnerability CVE-2018-11775

Vulnerability Name:

CVE-2018-11775 (CCN-149705)

Assigned:

2018-09-10

Published:

2018-09-10

Updated:

2021-03-05

Summary:

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

CVSS v3 Severity:

7.4 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
6.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): None

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

5.4 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-295

Vulnerability Consequences:

Gain Access

References:

Vulnerable Configuration:

Configuration 1:

cpe:/a:apache:activemq:*:*:*:*:*:*:*:* (Version < 5.15.6)

Configuration 2:

cpe:/a:oracle:flexcube_private_banking:12.0.1.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.0.3.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.1.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:2.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:2.2.0.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:apache:activemq:5.2.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.5.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.7.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.6.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.4.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.3.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.1.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.8.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.9.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.10.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.11.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.12.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.13.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.14.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.15.0:*:*:*:*:*:*:*

OR cpe:/a:apache:activemq:5.15.5:*:*:*:*:*:*:*

AND

cpe:/a:ibm:sterling_secure_proxy:3.4.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:enterprise_manager:12.1.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_secure_proxy:3.4.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:enterprise_manager:13.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:2.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:2.2.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:urbancode_deploy:6.2.7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:cognos_command_center:10.2.4.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:jazz_for_service_management:1.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:urbancode_deploy:7.0.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:urbancode_deploy:7.0.4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:urbancode_deploy:6.2.7.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3.3:p4:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4.0:-:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4.1:-:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.disco:def:2018117750000000	V	CVE-2018-11775 on Ubuntu 19.04 (disco) - medium.	2018-09-10
oval:com.ubuntu.bionic:def:201811775000	V	CVE-2018-11775 on Ubuntu 18.04 LTS (bionic) - medium.	2018-09-10
oval:com.ubuntu.cosmic:def:2018117750000000	V	CVE-2018-11775 on Ubuntu 18.10 (cosmic) - medium.	2018-09-10
oval:com.ubuntu.cosmic:def:201811775000	V	CVE-2018-11775 on Ubuntu 18.10 (cosmic) - medium.	2018-09-10
oval:com.ubuntu.bionic:def:2018117750000000	V	CVE-2018-11775 on Ubuntu 18.04 LTS (bionic) - medium.	2018-09-10
oval:com.ubuntu.trusty:def:201811775000	V	CVE-2018-11775 on Ubuntu 14.04 LTS (trusty) - medium.	2018-09-10
oval:com.ubuntu.xenial:def:2018117750000000	V	CVE-2018-11775 on Ubuntu 16.04 LTS (xenial) - medium.	2018-09-10
oval:com.ubuntu.xenial:def:201811775000	V	CVE-2018-11775 on Ubuntu 16.04 LTS (xenial) - medium.	2018-09-10

BACK