CVE-2015-5254

Critical

Published: 08/01/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, allowing remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to upgrade Apache ActiveMQ to version 5.13.0 or later to mitigate this vulnerability.

Original NVD description (English source)

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.