CVE-2010-1587

Apache ActiveMQ <5.3.2 and <5.4.0 - Info Disclosure

Title source: llm

Description

The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.

Exploits (3)

exploitdb WRITEUP VERIFIED
by Veerendra G.G · textremotemultiple
https://www.exploit-db.com/exploits/33868
metasploit WORKING POC
by AbdulAziz Hariri, juan vazquez · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_activemq_traversal.rb
metasploit WORKING POC
by Veerendra G.G, juan vazquez · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_activemq_source_disclosure.rb

References (7)

Scores

EPSS 0.7794
EPSS Percentile 99.0%

Details

CWE
CWE-20
Status published
Products (7)
apache/activemq 5.0.0
apache/activemq 5.1.0
apache/activemq 5.2.0
apache/activemq 5.3.0
apache/activemq 5.3.1
apache/activemq 5.4-snapshot
org.apache.activemq/activemq-web-console 5.0.0 - 5.3.2Maven
Published Apr 28, 2010
Tracked Since Feb 18, 2026