CVE-2016-3088: apache activemq

csirt@kutim:~/threat-intel/cve/CVE-2016-3088

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 98,5%

Kerentanan Unrestricted Upload of File with Dangerous Type pada apache activemq. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 10 Februari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Rincian

Terbit di NVD: 1 Juni 2016
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 98,5% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Apache ActiveMQ Improper Input Validation Vulnerability
Masuk KEV: 10 Februari 2022
Tenggat CISA: 10 Agustus 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	activemq	Versi 5.0.0 hingga sebelum 5.14.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt advisory vendor
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.a... mailing list · advisory vendor
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.act... mailing list · patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088 pemerintah AS
http://rhn.redhat.com/errata/RHSA-2016-2036.html advisory pihak ketiga
http://www.securitytracker.com/id/1035951 broken link · advisory pihak ketiga · vdb entry
http://www.zerodayinitiative.com/advisories/ZDI-16-356 advisory pihak ketiga · vdb entry
http://www.zerodayinitiative.com/advisories/ZDI-16-357 advisory pihak ketiga · vdb entry
https://www.exploit-db.com/exploits/42283/ exploit · advisory pihak ketiga · vdb entry
https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activ... issue tracking · mailing list

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.