Skip to content
Fencer Intel
critical 9.1

CVE-2024-51127 json

hornetq vulnerable to file overwrite, sensitive information disclosure

published 2y ago modified 4mo ago also GHSA-r7mv-mv7m-pjw3 , EUVD-2024-3307

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.

Patch / fix

  • eap7-hornetq jboss enterprise application platform 7.4, jboss enterprise application platform eus 7.3 2.4.11-1.Final_redhat_00001.1.el7eap
  • eap7-hornetq-commons jboss enterprise application platform 7.4, jboss enterprise application platform eus 7.3 2.4.11-1.Final_redhat_00001.1.el7eap
  • eap7-hornetq-jms-client jboss enterprise application platform 7.4, jboss enterprise application platform eus 7.3 2.4.11-1.Final_redhat_00001.1.el7eap
  • eap7-hornetq-core-client jboss enterprise application platform 7.4, jboss enterprise application platform eus 7.3 2.4.11-1.Final_redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.21-2.GA_redhat_00001.1.el9eap
  • eap7-opensaml jboss enterprise application platform 7.4 3.4.6-1.redhat_00001.1.el9eap
  • eap7-hibernate jboss enterprise application platform 7.4 5.3.37-1.Final_redhat_00001.1.el9eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.25-1.Final_redhat_00001.1.el9eap

red hat advisories RHSA-2025:16668RHSA-2025:16667RHSA-2025:1638RHSA-2025:1636RHSA-2025:1637RHSA-2025:0371

Is CVE-2024-51127 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-51127 updated cvss 7.1

hornetq-core-client: Arbitrarily overwrite files or access sensitive information

  • Red Hat Fuse 7 hornetq-core-client Red Hat JBoss Data Grid 7 hornetq-core-client
    affected: workaround, no fix planned “There is currently no known mitigation for this vulnerability.”
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-opensaml 3.4.6-1.redhat_00001.1.el7eap, eap7-wildfly 7.4.21-2.GA_redhat_00001.1.el7eap, eap7-xml-security 2.3.5-1.redhat_00001.1.el7eap, eap7-netty 4.1.119-1.Final_redhat_00004.1.el7eap, eap7-opensaml-core 3.4.6-1.redhat_00001.1.el7eap, eap7-hornetq 2.4.11-1.Final_redhat_00001.1.el7eap, +58 more
    fixed: vendor fix “There is currently no known mitigation for this vulnerability.” RHSA-2025:1636
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-opensaml 3.4.6-1.redhat_00001.1.el8eap, eap7-wildfly 7.4.21-2.GA_redhat_00001.1.el8eap, eap7-xml-security 2.3.5-1.redhat_00001.1.el8eap, eap7-netty 4.1.119-1.Final_redhat_00004.1.el8eap, eap7-opensaml-core 3.4.6-1.redhat_00001.1.el8eap, eap7-hornetq 2.4.11-1.Final_redhat_00001.1.el8eap, +60 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-opensaml 3.4.6-1.redhat_00001.1.el9eap, eap7-wildfly 7.4.21-2.GA_redhat_00001.1.el9eap, eap7-xml-security 2.3.5-1.redhat_00001.1.el9eap, eap7-netty 4.1.119-1.Final_redhat_00004.1.el9eap, eap7-opensaml-core 3.4.6-1.redhat_00001.1.el9eap, eap7-hornetq 2.4.11-1.Final_redhat_00001.1.el9eap, +57 more
    fixed: vendor fix “There is currently no known mitigation for this vulnerability.” RHSA-2024:11529
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-vdx 1.1.6-3.redhat_1.1.el8eap, eap8-ecj 3.31.0-2.redhat_00001.1.el8eap, eap8-vdx-core 1.1.6-3.redhat_1.1.el8eap, eap8-jansi 1.18.0-2.redhat_00001.1.el8eap, eap8-yasson 3.0.4-1.redhat_00002.1.el8eap, eap8-jctools 4.0.5-1.redhat_00001.1.el8eap, +114 more
    fixed: vendor fix “There is currently no known mitigation for this vulnerability.” RHSA-2024:11559
  • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-vdx 1.1.6-3.redhat_1.1.el9eap, eap8-ecj 3.31.0-2.redhat_00001.1.el9eap, eap8-vdx-core 1.1.6-3.redhat_1.1.el9eap, eap8-jansi 1.18.0-2.redhat_00001.1.el9eap, eap8-yasson 3.0.4-1.redhat_00002.1.el9eap, eap8-jctools 4.0.5-1.redhat_00001.1.el9eap, +114 more
    fixed: vendor fix “There is currently no known mitigation for this vulnerability.” RHSA-2025:0371
  • Red Hat JBoss Enterprise Application Platform hornetq-core-client 2.4.11.Final-redhat-00001
    fixed: vendor fix “There is currently no known mitigation for this vulnerability.” RHSA-2025:1635
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix “There is currently no known mitigation for this vulnerability.” RHSA-2024:11531
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.12-2.GA_redhat_00002.1.ep7.el7, eap7-hornetq 2.4.11-1.Final_redhat_00001.1.ep7.el7, eap7-undertow 1.4.18-17.SP15_redhat_00001.1.ep7.el7, eap7-wildfly-modules 7.1.12-2.GA_redhat_00002.1.ep7.el7, eap7-hornetq-commons 2.4.11-1.Final_redhat_00001.1.ep7.el7, eap7-hibernate-validator 5.3.6-1.SP1_redhat_00001.1.ep7.el7, +4 more
    fixed: vendor fix “There is currently no known mitigation for this vulnerability.” RHSA-2025:16668
show 3 more
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.15-5.GA_redhat_00003.1.el7eap, eap7-undertow 2.0.41-5.SP6_redhat_00001.1.el7eap, eap7-hornetq 2.4.11-1.Final_redhat_00001.1.el7eap, eap7-wildfly-modules 7.3.15-5.GA_redhat_00003.1.el7eap, eap7-wildfly-javadocs 7.3.15-5.GA_redhat_00003.1.el7eap, eap7-wildfly-java-jdk8 7.3.15-5.GA_redhat_00003.1.el7eap, +27 more
    fixed: vendor fix “There is currently no known mitigation for this vulnerability.” RHSA-2025:16667
  • Red Hat JBoss Enterprise Application Platform 8
    fixed: vendor fix “There is currently no known mitigation for this vulnerability.” RHSA-2024:11570
  • Red Hat Build of Keycloak hornetq-core-client Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1941 more Red Hat JBoss Enterprise Application Platform Expansion Pack hornetq-core-client, org.jboss.eap-jboss-eap org.jboss.eap-jboss-eap, org.jboss.eap-jboss-eap-xp org.jboss.eap-jboss-eap-xp Red Hat Process Automation 7 hornetq-core-client Red Hat Single Sign-On 7 hornetq-core-client
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2y ago

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • github.com https://github.com/JAckLosingHeart/CWE-378/blob/main/CVE-2024-51127.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.hornetq:hornetq-core-client
<=2.4.9
 no fix listed

Affected products

  • redhat hornetq

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.