High severity · published Sep 25, 2017
CVE-2015-5182
Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Amq · Redhat
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5182
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5182
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1248809
lists.apache.org
https://lists.apache.org/thread.html/9e3391878c6840b294155f7ba6ccb47586e317f85c1bbd15c4608bd0%40%3Cdev.activemq.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rb280e767ab199767e07a367f287ba08a9692fa76e2da4a20d50d07c4%40%3Cdev.activemq.apache.org%3E
More from Amq
7.5
CVE-2022-1278
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain
7.5
CVE-2015-5184
Console: CORS headers set to allow all in Red Hat AMQ
7.5
CVE-2015-5183
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ
6.5
CVE-2020-14307
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote…
6.5
CVE-2020-14297
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause…