CVE-2018-11775: apache software foundation apache activemq Improper Certificate Validation

EPSS trend

Probability

6.96%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 6.96% on 18-09-2026

18-09-202618-10-2026

EPSS score

6.96%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

32 links

www.securitytracker.com/id/1041618VDB EntryX Refsource SECTRACKThird Party Advisory
www.securityfocus.com/bid/105335VDB EntryX Refsource BIDThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
access.redhat.com/errata/RHSA-2019:3892Vendor AdvisoryX Refsource REDHATWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISC
www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchThird Party Advisory

Show all 32 references

www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISC
www.oracle.com/security-alerts/cpujan2021.htmlX Refsource MISC
activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txtX Refsource CONFIRMVendor AdvisoryREPORTWEB
lists.debian.org/debian-lts-announce/2021/03/msg00005.htmlMailing ListX Refsource MLISTWEB
ubuntu.com/security/CVE-2018-11775REPORT
git-wip-us.apache.org/repos/asf?p=activemq.git;a=commit;h=bde7097fb8173cf871827df7811b3865679b963dREPORT
git-wip-us.apache.org/repos/asf?p=activemq.git;a=commit;h=02971a40e281713a8397d3a1809c164b594abfbbREPORT
www.cve.org/CVERecord?id=CVE-2018-11775REPORT
ubuntu.com/security/notices/USN-6910-1Advisory
security-tracker.debian.org/tracker/CVE-2018-11775Advisory
nvd.nist.gov/vuln/detail/CVE-2018-11775Advisory
github.com/apache/activemq/commit/02971a40e281713a8397d3a1809c164b594abfbbWEB
github.com/apache/activemq/commit/bde7097fb8173cf871827df7811b3865679b963dWEB
github.com/advisories/GHSA-m9w8-v359-9ffrAdvisory
github.com/apache/activemqPACKAGE
issues.apache.org/jira/browse/AMQ-7047WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB

Related vulnerabilities

CVE-2018-1258org.springframeworkspring-core+422.46%8y ago11-05-2018 20:00Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.CVE-2018-1000613chainguardeco-java-gradle-4.10+434.77%8y ago09-07-2018 20:00Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.CVE-2018-1000180chainguardeco-java-gradle-1.11+753.42%8y ago05-06-2018 13:00Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.CVE-2018-8006apache software foundationapache activemq+455.42%8y ago10-10-2018 14:00An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.CVE-2018-8013apache software foundationapache batik+2418.93%8y ago24-05-2018 16:00In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.CVE-2018-3246oracle corporationweblogic server+92.95%8y ago17-10-2018 01:00Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

All vulnerabilities inapache activemq activemq enterprise_repository flexcube_private_banking

CVE-2018-11775: apache software foundation apache activemq Improper Certificate Validation

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References