CVE-2020-11998: apache activemq
Vulnerability summary
CVE-2020-11998 is a critical (CVSS 9.8) vulnerability in apache activemq. EPSS estimates a 48.88% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities.
Timeline
- 10-09-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
48.88%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
-2.34 pp
From 51.23% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle6 products
- communications_diameter_signaling_router≥ 8.0.0, ≤ 8.5.0
- communications_element_manager≥ 8.2.0, ≤ 8.2.4.0
- communications_session_report_manager≥ 8.0.0, ≤ 8.2.2
- communications_session_route_manager≥ 8.0.0, ≤ 8.2.2
- enterprise_repository11.1.1.7.0
Apache1 product
- activemqEOL5.15.12
Org.apache.activemq1 product
- activemq-parent≥ 5.15.12, < 5.15.13
Ubuntu1 product
- activemqAll versions (No fix recorded)
4 vendors · 9 products
References
15 links- activemq.apache.org/security-advisories.data/CVE-2020-11998-announcement.txtX Refsource MISCREPORTWEBVendor Advisory
