What’s Vulnerable › Vulnerabilities

CVE-2013-3060

• Severity: medium (CVSS 6.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-04-21 · updated 2026-06-16
• Weakness: CWE-287

Description

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.

Affected products

• Apache ActiveMQ: through 5.7.0; 4.0, 4.0-m4, 4.0-rc2, 4.0.1, 4.0.2, 4.1.0 (+13)

References

• http://activemq.2283324.n4.nabble.com/DISCUSS-ActiveMQ-out-of-the-box-Should-not-include-the-demos-tc4658044.html
• http://activemq.apache.org/activemq-580-release.html
• http://rhn.redhat.com/errata/RHSA-2013-1029.html
• http://rhn.redhat.com/errata/RHSA-2013-1221.html
• http://www.securityfocus.com/bid/59402
• https://fisheye6.atlassian.com/changelog/activemq?cs=1404998
• https://issues.apache.org/jira/browse/AMQ-4124
• https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282
• http://activemq.2283324.n4.nabble.com/DISCUSS-ActiveMQ-out-of-the-box-Should-not-include-the-demos-tc4658044.html
• http://activemq.apache.org/activemq-580-release.html
• http://rhn.redhat.com/errata/RHSA-2013-1029.html
• http://rhn.redhat.com/errata/RHSA-2013-1221.html

Get alerted when CVE-2013-3060 or the next vulnerability affects your stack