CVE-2016-3088

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-3088
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt Vendor Advisory
http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2036.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2036.html Third Party Advisory
http://www.securitytracker.com/id/1035951 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035951 Broken Link Third Party Advisory VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-356 Third Party Advisory VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-356 Third Party Advisory VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-357 Third Party Advisory VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-357 Third Party Advisory VDB Entry
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E Mailing List Patch
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E Mailing List Patch
https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E Issue Tracking Mailing List
https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E Issue Tracking Mailing List
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E Mailing List Vendor Advisory
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E Mailing List Vendor Advisory
https://www.exploit-db.com/exploits/42283/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/42283/ Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
History

28 Jan 2025, 18:18

Type Values Removed Values Added
References (SECTRACK) http://www.securitytracker.com/id/1035951 - Broken Link, Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1035951 - Broken Link, Third Party Advisory, VDB Entry
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/42283/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/42283/ - Exploit, Third Party Advisory, VDB Entry
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-2036.html - Third Party Advisory () http://rhn.redhat.com/errata/RHSA-2016-2036.html - Third Party Advisory
References (MISC) http://www.zerodayinitiative.com/advisories/ZDI-16-357 - Third Party Advisory, VDB Entry () http://www.zerodayinitiative.com/advisories/ZDI-16-357 - Third Party Advisory, VDB Entry
References (CONFIRM) http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt - Vendor Advisory () http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt - Vendor Advisory
References (MISC) http://www.zerodayinitiative.com/advisories/ZDI-16-356 - Third Party Advisory, VDB Entry () http://www.zerodayinitiative.com/advisories/ZDI-16-356 - Third Party Advisory, VDB Entry

24 Jul 2024, 16:04

Type Values Removed Values Added
CWE CWE-20 CWE-434
References (CONFIRM) http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt - (CONFIRM) http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt - Vendor Advisory
References () https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E - () https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E - Mailing List, Patch
References (MISC) http://www.zerodayinitiative.com/advisories/ZDI-16-357 - (MISC) http://www.zerodayinitiative.com/advisories/ZDI-16-357 - Third Party Advisory, VDB Entry
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/42283/ - (EXPLOIT-DB) https://www.exploit-db.com/exploits/42283/ - Exploit, Third Party Advisory, VDB Entry
References () https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E - () https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E - Issue Tracking, Mailing List
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-2036.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-2036.html - Third Party Advisory
References (SECTRACK) http://www.securitytracker.com/id/1035951 - (SECTRACK) http://www.securitytracker.com/id/1035951 - Broken Link, Third Party Advisory, VDB Entry
References (MISC) http://www.zerodayinitiative.com/advisories/ZDI-16-356 - (MISC) http://www.zerodayinitiative.com/advisories/ZDI-16-356 - Third Party Advisory, VDB Entry
References () https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E - () https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E - Mailing List, Vendor Advisory

07 Nov 2023, 02:32

Type Values Removed Values Added
References
  • {'url': 'https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a@%3Cusers.activemq.apache.org%3E', 'name': '[activemq-users] 20190703 Re: ActiveMQ cve vulnerabilities seen in latest version', 'tags': [], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E', 'name': '[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/', 'tags': [], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E', 'name': '[announce] 20200131 Apache Software Foundation Security Report: 2019', 'tags': [], 'refsource': 'MLIST'}
  • () https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E -
  • () https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E -
  • () https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E -
Information

Published : 2016-06-01 20:59

Updated : 2025-04-02 20:17

NVD link : CVE-2016-3088

Mitre link : CVE-2016-3088

JSON object : View

Products Affected

apache

  • activemq
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type