Description
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txtVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2036.htmlThird Party Advisory
- http://www.securitytracker.com/id/1035951Broken Link, Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-356Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-357Third Party Advisory, VDB Entry
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3EMailing List, Patch
- https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3EMailing List, Vendor Advisory
- https://www.exploit-db.com/exploits/42283/Exploit, Third Party Advisory, VDB Entry
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txtVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2036.htmlThird Party Advisory
- http://www.securitytracker.com/id/1035951Broken Link, Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-356Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-357Third Party Advisory, VDB Entry
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3EMailing List, Patch
- https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3EIssue Tracking, Mailing List
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3EMailing List, Vendor Advisory
- https://www.exploit-db.com/exploits/42283/Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088US Government Resource
Timeline
- Published
- Jun 1, 2016
- Last modified
- Jun 17, 2026
- Added to CISA KEV
- Feb 10, 2022
- NVD status
- Analyzed