CVE-2020-36282

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/rabbitmq/rabbitmq-jms-client/issues/135Patch, Third Party Advisory
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2Release Notes, Third Party Advisory
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0Release Notes, Third Party Advisory
https://medium.com/%40ramon93i7/a99645d0448b
https://github.com/rabbitmq/rabbitmq-jms-client/issues/135Patch, Third Party Advisory
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2Release Notes, Third Party Advisory
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0Release Notes, Third Party Advisory
https://medium.com/%40ramon93i7/a99645d0448b

Timeline

Published: Mar 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-362838.8HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation Mode). By persuading an authe CVE-2020-362847.5Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attacker CVE-2020-362857.5Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows atta CVE-2020-362865.3The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v CVE-2020-362875.3The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, an CVE-2020-362886.1The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and fro CVE-2020-362895.3Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu CVE-2020-36297.8u'Stack out of bound issue occurs when making query to DSP capabilities due to wrong assumption was made on determining the buffer size for CVE-2020-362905.4The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 befo CVE-2020-36307.8Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Con CVE-2020-363066.1Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.CVE-2020-363076.1Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.