Threats tagged 'ghsa-h5gm-rvw6-2xpx'

Apache ActiveMQ Broker versions before 5.19.8 and from 6.0.0 before 6.2.7 contain an improper input validation vulnerability. An attacker with the ability to publish or modify LDAP entries matching the configured searchBase and searchFilter can instantiate denied transports within the broker JVM. This can lead to fetching an attacker-controlled URL and spawning a second BrokerService inside the same JVM. The issue is fixed in versions 5.19.8 and 6.2.7.