CVE-2016-3088
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jun 1, 2016
- Updated
- Oct 21, 2025
- Reserved
- Mar 10, 2016
Description
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://www.zerodayinitiative.com/advisories/ZDI-16-356
- 42283exploit
- http://www.zerodayinitiative.com/advisories/ZDI-16-357
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt
- RHSA-2016:2036vendor-advisory
- 1035951vdb-entry
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/mailing-list
- [activemq-users] 20190703 Re: ActiveMQ cve vulnerabilities seen in latest versionmailing-list
- [announce] 20200131 Apache Software Foundation Security Report: 2019mailing-list
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.