VDB

CVE-2021-26118

CVE-2021-26118 PUBLISHED CVSS 7.5 HIGH

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

EPSS 3.92% · 89.5th percentile

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
3.92%
89.5th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:18.04:LTSactivemq5.14.5-3, 5.15.2-2, 5.15.3-2
Ubuntu:Pro:16.04:LTSactivemq5.13.2+dfsg-2ubuntu0.1~esm1, 0, 5.6.0+dfsg1-4+deb8u1ubuntu1
Ubuntu:Pro:20.04:LTSactivemq5.15.10-1, 5.15.11-1, 5.15.11-1ubuntu0.1~esm1
Ubuntu:Pro:22.04:LTSactivemq0, 5.16.1-1ubuntu0.1~esm1, 5.16.1-1ubuntu0.1

Timeline

  • Jan 27, 2021 CVE Published
  • Jan 27, 2021 PoC Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 27, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 27, 2021 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Feb 28, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 2, 2022 EPSS Score
  • Sep 5, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›