CVE-2015-5254 PUBLISHED

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

EPSS 80.38% · 99.1th percentile

Risk Scores

EPSS Score
80.38%
99.1th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSactivemq0, 5.6.0+dfsg-1, 5.6.0+dfsg-1+deb7u1build0.14.04.1

Timeline

References

Open in Interactive Console →