This vulnerability involves improper input validation (CWE-22) in Apache ActiveMQ Client and Broker components, where an authenticated user can supply a crafted 'key' parameter that leads to classpath traversal due to unsafe path concatenation. This affects versions before 5.19.4 and 6.2.3, with earlier partial fixes in 5.19.3 and 6.2.2 limited to non-Windows platforms. The issue is specifically triggered during Stomp consumer creation and message browsing in the Web console. The vendor recommends upgrading to 5.19.4 or 6.2.3 to fully remediate the vulnerability.

An authenticated user can exploit this vulnerability to traverse the classpath, potentially accessing unintended resources. While the direct impact is resource loading exposure, the vulnerability could be combined with other exploits to achieve further compromise. No known exploits in the wild have been reported. The vulnerability affects Apache ActiveMQ Client, Broker, and All versions prior to the fixed releases.

A fix is available. Users should upgrade to Apache ActiveMQ versions 5.19.4 or 6.2.3, which fully address the vulnerability including Windows path separator issues. Versions 5.19.3 and 6.2.2 partially fix the issue but do not resolve it on Windows platforms. No other mitigations are indicated by the vendor advisory.