CVE-2020-36282

CRITICAL

RabbitMQ JMS Client 1.0.0-1.15.1 and 2.0-2.1.9 - Remote Code Execution via StreamMessage Deserialization

Title source: llm
STIX 2.1

Description

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.

References (4)

Core 4
Core References
Various Sources x_refsource_misc
https://medium.com/%40ramon93i7/a99645d0448b
Patch, Third Party Advisory x_refsource_misc
https://github.com/rabbitmq/rabbitmq-jms-client/issues/135
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0

Scores

CVSS v3 9.8
EPSS 0.0284
EPSS Percentile 84.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (2)
com.rabbitmq.jms/rabbitmq-jms 2.0 - 2.2.0Maven
rabbitmq/jms_client 1.0.0 - 1.15.2
Published Mar 12, 2021
Tracked Since Feb 18, 2026