← Vulnerability feed

Vulnerability record · CVE-2013-3060 · published 21 April 2013

CVE-2013-3060: Apache activemq improper authentication vulnerability

Apache · Activemq

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.

6.4 CVSS 2.0 Medium EPSS 6.3% · top 6.6% CWE-287 · Improper authentication
6.4CVSS 2.0 base score
6.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References
16 Jun 2026Last modified by NVD

Description

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.

AV:N/AC:L/Au:N/C:P/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://activemq.2283324.n4.nabble.com/DISCUSS-ActiveMQ-out-of-the-box-Should-not-include-the-demos-tc4658044.html
http://activemq.apache.org/activemq-580-release.html
http://rhn.redhat.com/errata/RHSA-2013-1029.html
http://rhn.redhat.com/errata/RHSA-2013-1221.html
http://www.securityfocus.com/bid/59402
https://fisheye6.atlassian.com/changelog/activemq?cs=1404998
https://issues.apache.org/jira/browse/AMQ-4124
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282
http://activemq.2283324.n4.nabble.com/DISCUSS-ActiveMQ-out-of-the-box-Should-not-include-the-demos-tc4658044.html
http://activemq.apache.org/activemq-580-release.html
http://rhn.redhat.com/errata/RHSA-2013-1029.html
http://rhn.redhat.com/errata/RHSA-2013-1221.html
http://www.securityfocus.com/bid/59402
https://fisheye6.atlassian.com/changelog/activemq?cs=1404998
https://issues.apache.org/jira/browse/AMQ-4124
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282

Track CVE-2013-3060 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-46604Apache ActiveMQ OpenWire deserialization remote code executionThe Java OpenWire protocol marshaller in Apache ActiveMQ deserializes untrusted data, letting an attacker manipulate serialized class types so the br…KEVEPSS 100%analysed9.8CVE-2016-3088Apache ActiveMQ Fileserver unrestricted file upload to RCEThe Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 accepts HTTP PUT uploads and HTTP MOVE requests without adequate validation, lett…KEVEPSS 99%analysed8.8CVE-2026-34197Apache ActiveMQ Jolokia JMX bridge code injection via broker config URIApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ with a default policy that allows exec operations on all org.apache.acti…KEVEPSS 15%analysed9.9CVE-2021-21345XStream deserialization allows remote command executionXStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, allowing code injection and OS command execution. The flaw is a …EPSS 72%analysed9.8CVE-2021-21347Netapp oncommand insight unrestricted file upload vulnerabilityXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re…EPSS 14%9.8CVE-2021-21350Netapp oncommand insight unrestricted file upload vulnerabilityXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re…EPSS 15%9.8CVE-2021-21344XStream deserialization allows remote code executionXStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, letting a remote attacker craft a stream that loads and executes…EPSS 76%analysed9.8CVE-2021-21346XStream deserialization allows remote code executionXStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, letting a remote attacker load and execute arbitrary code by man…EPSS 76%analysed

Source: NIST National Vulnerability Database (record CVE-2013-3060), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.