CVE-2012-6551
Apache ActiveMQ default configuration subject to denial of service
The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
Exploit likelihood
What each source reports
NVD Score used
The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
- Record
CVE-2012-6551- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
- Record
CVE-2012-6551- Updated
- 2026-11-02
EUVDEUVD-2022-2104 No score
The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
- Record
EUVD-2022-2104- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-34fp-xvxp-rg22 No score
Apache ActiveMQ default configuration subject to denial of service
The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
- Record
GHSA-34fp-xvxp-rg22- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-34fp-xvxp-rg22 No score
Apache ActiveMQ default configuration subject to denial of service
The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
- Record
GHSA-34fp-xvxp-rg22- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:apache-activemqMaven |
before 5.8.0 | 5.8.0 |
org.apache.activemq:activemq-web-demoMaven |
before 5.8.0 | 5.8.0 |
org.apache.activemq:apache-activemqMaven |
before 5.8.0, plus listed versions 4.1.14.1.25.0.05.1.05.2.0 Show 11 moreShow less5.3.05.3.15.3.25.4.05.4.15.4.25.4.35.5.05.5.15.6.05.7.0 |
5.8.0 |
org.apache.activemq:activemq-web-demoMaven |
before 5.8.0, plus listed versions 4.1.14.1.25.0.05.1.05.2.0 Show 11 moreShow less5.3.05.3.15.3.25.4.05.4.15.4.25.4.35.5.05.5.15.6.05.7.0 |
5.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-6551 is a medium vulnerability (CVSS 5.0) in Apache Activemq, published April 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.77%, the 94th percentile. Fixed in org.apache.activemq:apache-activemq 5.8.0.
References
rhn.redhat.com/errata/RHSA-2013-1029.html
activemq.2283324.n4.nabble.com/DISCUSS-ActiveMQ-out-of-the-box-Should-not-include-the-demos-tc4658044.html
fisheye6.atlassian.com/changelog/activemq?cs=1404998
securityfocus.com/bid/59401
activemq.apache.org/activemq-580-release.html
issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-6551
web.archive.org/web/20130916074709/http://activemq.2283324.n4.nabble.com/DISCUSS-ActiveMQ-out-of-the-box-Should-not-include-the-demos-tc4658044.html
github.com/apache/activemq/commit/22bc55b9487df98a3c3cb04f99f4618fcba364fe