Threats tagged 'ghsa-w3w2-mpp5-92gm'

Apache ActiveMQ contains an improper input validation and code injection vulnerability that allows an authenticated attacker to bypass previous fixes by adding a connector using an HTTP Discovery transport via Jolokia if the activemq-http module is present. This can lead to arbitrary code execution on the broker's JVM through Spring XML application context loading before configuration validation. The issue affects versions before 5.19.6 and from 6.0.0 before 6.2.5. Upgrading to versions 5.19.6 or 6.2.5 mitigates the vulnerability.