CVE-2016-3088
KEV
🔴 Łataj teraz
Luka w Apache ActiveMQ umożliwia zdalne przesyłanie i wykonywanie dowolnych plików.
CVSS
9.8
EPSS
94.2%
Exploit
weaponized
Vendor
apache
Opis źródłowy (NVD)
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.8 |
| CISA KEV (aktywnie wykorzystywane) | Tak |
| FIRST EPSS (prawdopodobieństwo exploita) | 94.2% |
| Opublikowano (NVD) | 2016-06-01 20:59:04 UTC |
| Ostatnia modyfikacja (NVD) | 2026-04-21 19:14:32 UTC |
Referencje
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt (secalert@redhat.com) [Vendor Advisory]
- http://rhn.redhat.com/errata/RHSA-2016-2036.html (secalert@redhat.com) [Third Party Advisory]
- http://www.securitytracker.com/id/1035951 (secalert@redhat.com) [Broken Link, Third Party Advisory, VDB Entry]
- http://www.zerodayinitiative.com/advisories/ZDI-16-356 (secalert@redhat.com) [Third Party Advisory, VDB Entry]
- http://www.zerodayinitiative.com/advisories/ZDI-16-357 (secalert@redhat.com) [Third Party Advisory, VDB Entry]
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E (secalert@redhat.com) [Mailing List, Patch]
- https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E (secalert@redhat.com) [Issue Tracking, Mailing List]
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E (secalert@redhat.com) [Mailing List, Vendor Advisory]
- https://www.exploit-db.com/exploits/42283/ (secalert@redhat.com) [Exploit, Third Party Advisory, VDB Entry]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]