{
  "threat_severity" : "Important",
  "public_date" : "2016-05-24T00:00:00Z",
  "bugzilla" : {
    "description" : "activemq: Fileserver web application vulnerability allowing RCE",
    "id" : "1339318",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1339318"
  },
  "cvss" : {
    "cvss_base_score" : "6.8",
    "cvss_scoring_vector" : "AV:N/AC:M/Au:N/C:P/I:P/A:P",
    "status" : "verified"
  },
  "cwe" : "CWE-22",
  "details" : [ "The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request." ],
  "statement" : "Red Hat JBoss A-MQ 6.3 , Red Hat JBoss Fuse 6.3, and Red Hat JBoss Fuse Service Works 6.0.0 do not provide the vulnerable component and are not affected by this flaw. Red Hat JBoss A-MQ 6.2.1 and Red Hat JBoss Fuse 6.2.1 disable the vulnerable component and as such are not vulnerable to this flaw. The fileserver component was first disabled in A-MQ 6.2.0 and Fuse 6.2.0. Users of older, unsupported versions of these products are strongly advised to observe the mitigation provided on this page.",
  "affected_release" : [ {
    "product_name" : "Red Hat JBoss A-MQ 6.3",
    "release_date" : "2016-10-06T00:00:00Z",
    "advisory" : "RHSA-2016:2036",
    "cpe" : "cpe:/a:redhat:jboss_amq:6.3"
  }, {
    "product_name" : "Red Hat JBoss Fuse 6.2",
    "release_date" : "2015-06-23T00:00:00Z",
    "advisory" : "RHSA-2015:1176",
    "cpe" : "cpe:/a:redhat:jboss_fuse:6.2.0"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat JBoss A-MQ 6",
    "fix_state" : "Affected",
    "package_name" : "activemq",
    "cpe" : "cpe:/a:redhat:jboss_amq:6",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat JBoss Fuse 6",
    "fix_state" : "Affected",
    "package_name" : "activemq",
    "cpe" : "cpe:/a:redhat:jboss_fuse:6",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat JBoss Fuse Service Works 6",
    "fix_state" : "Not affected",
    "package_name" : "activemq",
    "cpe" : "cpe:/a:redhat:jboss_fuse_service_works:6"
  }, {
    "product_name" : "Red Hat OpenShift Enterprise 2",
    "fix_state" : "Not affected",
    "package_name" : "activemq",
    "cpe" : "cpe:/a:redhat:openshift:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2016-3088\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-3088\nhttp://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog" ],
  "name" : "CVE-2016-3088",
  "mitigation" : {
    "value" : "Users are advised to use other FTP and HTTP based file servers for transferring blob messages. Fileserver web application SHOULD NOT be used in older version of the broker and it should be disabled (it has been disabled by default since 5.12.0). This can be done by removing (commenting out) the following lines from conf\\jetty.xml file\n<bean class=\"org.eclipse.jetty.webapp.WebAppContext\">\n<property name=\"contextPath\" value=\"/fileserver\" />\n<property name=\"resourceBase\" value=\"${activemq.home}/webapps/fileserver\" />\n<property name=\"logUrlOnStart\" value=\"true\" />\n<property name=\"parentLoaderPriority\" value=\"true\" />\n</bean>",
    "lang" : "en:us"
  },
  "csaw" : false
}