CVE-2016-3088
9.8
CRITICAL
CVSS 3.1
EPSS 98.5% · 100th pctCISA KEV · Exploited in the wild
2016-06-01•Updated 2025-10-21•KEV 2022-02-10
CISA Known Exploited Vulnerabilities
Apache ActiveMQ Improper Input Validation Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Added to KEV
2022-02-10
Remediation due
2022-08-10
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2016-3088
Description
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Severity
CVSS 3.1 · CISA9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impacttotal
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| - | - | n/a |
References
9 LinksVendor advisories
Exploits & PoCs
Mailing lists
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/
- [activemq-users] 20190703 Re: ActiveMQ cve vulnerabilities seen in latest version
- [announce] 20200131 Apache Software Foundation Security Report: 2019
Vulnerability databases
Record Details
Published
2016-06-01
Last updated
2025-10-21
Assigner (CNA)
redhat
Credited to
-
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.