CVE-2010-1587: Apache ActiveMQ Jetty ResourceHandler JSP source disclosure via double slash URI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is trivially reachable without authentication and has very high EPSS with public exploit references, though it only discloses source rather than enabling direct compromise.

What it is

Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 exposes JSP source code through the Jetty ResourceHandler when a URI begins with a double slash (//). A remote attacker can retrieve the raw source of admin/index.jsp, admin/queues.jsp, or admin/topics.jsp instead of their executed output. This leaks server-side logic and any credentials or configuration embedded in those pages.

Impact

An attacker gains read access to the source of the ActiveMQ admin JSP pages, which can reveal application logic, internal paths, and hardcoded credentials or configuration. It does not by itself grant code execution or write access.

Attack surface

Reachable over the network through the ActiveMQ web console HTTP interface by requesting the affected JSP paths with a leading // substring. No authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.78, 99.5th percentile) and an OSVDB reference is tagged Exploit, indicating public exploit material exists. No ransomware association is documented.

What to do

• Upgrade Apache ActiveMQ to 5.3.2 or 5.4.0 (or later) to obtain the fix tracked in AMQ-2700.
• If immediate upgrade is not possible, restrict network access to the ActiveMQ web console to trusted management hosts only.
• Disable or remove the admin web console if it is not required in production.
• Place the console behind an authenticating reverse proxy and block URIs containing a leading double slash.
• Monitor vendor advisories for any backported fixes for maintained branches.

Detection

• Inspect web server and ActiveMQ access logs for requests whose URI path begins with // and targets admin/*.jsp.
• Alert on HTTP responses returning JSP source markers (for example <% or <%@) from the ActiveMQ console.
• Baseline normal console request patterns and flag anomalous direct .jsp requests from unexpected source IPs.
• Review network logs for external hosts reaching the ActiveMQ admin console port.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.