Vulnerability Details : CVE-2016-3088

Public exploit exists!
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Published 2016-06-01 20:59:04
Updated 2019-03-27 20:29:03
Source Red Hat, Inc.
View at NVD,   CVE.org
Vulnerability category: Input validation

CVE-2016-3088 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Apache ActiveMQ Improper Input Validation Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
Added on 2022-02-10 Action due date 2022-08-10

Exploit prediction scoring system (EPSS) score for CVE-2016-3088

Probability of exploitation activity in the next 30 days: 83.96%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2016-3088

  • ActiveMQ web shell upload
    Disclosure Date: 2016-06-01
    First seen: 2020-04-26
    exploit/multi/http/apache_activemq_upload_jsp
    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. Authors: - Ian Anderson <andrsn84@gmail.com> - Hillary Benson <1n7r1gu3@gmail.com>

CVSS scores for CVE-2016-3088

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST
9.8
 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST

CWE ids for CVE-2016-3088

  • The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-3088

Products affected by CVE-2016-3088

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close