Improper Authentication in Apache ActiveMQ Artemis and ActiveMQ - CVE-2021-26117
Published: January 27, 2021 / Updated: January 28, 2021
Vulnerability identifier: #VU50072
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-26117
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to a logic error in ActiveMQ LDAP login module when configured to to use anonymous access to the LDAP server. A remote attacker can provide a valid username and no password and gain unauthorized access to the system.
Affected software
Apache ActiveMQ Artemis
Oracle Enterprise Data Quality
ActiveMQ
Oracle FLEXCUBE Private Banking
Ubuntu
activemq (Ubuntu package)
libactivemq-java (Ubuntu package)
Fuse
Oracle Enterprise Data Quality
ActiveMQ
Oracle FLEXCUBE Private Banking
Ubuntu
activemq (Ubuntu package)
libactivemq-java (Ubuntu package)
Fuse
How to mitigate CVE-2021-26117
Install updates from vendor's website.
Apache ActiveMQ Artemis - update to 2.16.0
ActiveMQ - addressed in versions 5.15.14, 5.16.1
activemq (Ubuntu package) - update to Ubuntu Pro
libactivemq-java (Ubuntu package) - update to Ubuntu Pro
Fuse - update to 6.3.0
ActiveMQ - addressed in versions 5.15.14, 5.16.1
activemq (Ubuntu package) - update to Ubuntu Pro
libactivemq-java (Ubuntu package) - update to Ubuntu Pro
Fuse - update to 6.3.0