CVE-2018-11775

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

Published: Sep 10, 2018
Updated: Nov 8, 2023
CVE: CVE-2018-11775
GHSA: GHSA-m9w8-v359-9ffr
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.4
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2:

Severity: Medium
Score: 5.8
AV:N/AC:M/Au:N/C:P/I:P/A:N

CWEs:

CWE-295

OWASP TOP 10:

A3 - Sensitive Data Exposure

Affected Software
References

Software	From	Fixed in
apache / activemq	-	5.15.6
oracle / flexcube_private_banking	2.2.0.1	2.2.0.1.x
oracle / enterprise_repository	12.1.3.0.0	12.1.3.0.0.x
oracle / flexcube_private_banking	2.0.0.0	2.0.0.0.x
oracle / flexcube_private_banking	12.0.1.0	12.0.1.0.x
oracle / flexcube_private_banking	12.0.3.0	12.0.3.0.x
oracle / flexcube_private_banking	12.1.0.0	12.1.0.0.x
org.apache.activemq / activemq-client	-	5.15.6

Vulnerability Database

289,599

CVE-2018-11775