CVE-2015-1830 json
Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ
published 11y ago modified 4mo ago also GHSA-3v63-f83x-37x4 , EUVD-2022-2240
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 84.4%
- EPSS 84.4% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 3
- Metasploit and Exploit-DB
Summary
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Patch / fix
- maven org.apache.activemq:activemq-client 5.11.2
Is CVE-2015-1830 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (EDB-40857)
- Published
Exploit prediction
84.41% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/windows/http/apache_activemq_traversal_upload Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload metasploit exploit, excellent rank, 2015-08-19
- EDB-48181 Apache ActiveMQ 5.x-5.11.1 - Directory Traversal Shell Upload (Metasploit) remote, 2020-03-09
- EDB-40857 Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution remote, 2015-08-17
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.activemq:activemq-client | >=5.0.0, <5.11.2 |
5.11.2 |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/apache/activemq/commit/729c4731574ffffaf58ebefdbaeb3bd19ed1c7b7
web
-
github.com
/apache/activemq/commit/9fd5cb7dfe0fcc431f99d5e14206e0090e72f36b
web
-
activemq.apache.org
/security-advisories.data/CVE-2015-1830-announcement.txt
web
-
securityfocus.com
/bid/76452
vdb-entry, web
-
zerodayinitiative.com
/advisories/ZDI-15-407
web
- zerodayinitiative.com /advisories/ZDI-15-407/
-
securitytracker.com
/id/1033315
vdb-entry, web
-
lists.apache.org
/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
mailing-list, web
-
packetstormsecurity.com
/files/156643/Apache-ActiveMQ-5.11.1-Directory-Traversal-Shell-Upload.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2015-1830
advisory
-
github.com
/apache/activemq
web
-
issues.apache.org
/jira/browse/AMQ-5754
web
-
lists.apache.org
/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E
web
Sources
- CVE List CVE-2015-1830
- GitHub Advisory GHSA-3v63-f83x-37x4
- NVD CVE-2015-1830
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.