CVE-2013-3060
Improper Authentication in Apache ActiveMQ
The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
Exploit likelihood
What each source reports
NVD Score used
The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
- Record
CVE-2013-3060- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
- Record
CVE-2013-3060- Updated
- 2026-11-02
EUVDEUVD-2022-4663 No score
The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
- Record
EUVD-2022-4663- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p358-58jj-hp65 No score
Improper Authentication in Apache ActiveMQ
The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
- Record
GHSA-p358-58jj-hp65- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-p358-58jj-hp65 No score
Improper Authentication in Apache ActiveMQ
The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
- Record
GHSA-p358-58jj-hp65- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:activemq-clientMaven |
before 5.8.0 | 5.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-3060 is a medium vulnerability (CVSS 6.4) in Apache Activemq, published April 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.31%, the 93rd percentile. Fixed in org.apache.activemq:activemq-client 5.8.0.
References
rhn.redhat.com/errata/RHSA-2013-1029.html
activemq.2283324.n4.nabble.com/DISCUSS-ActiveMQ-out-of-the-box-Should-not-include-the-demos-tc4658044.html
fisheye6.atlassian.com/changelog/activemq?cs=1404998
securityfocus.com/bid/59402
activemq.apache.org/activemq-580-release.html
issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-3060
github.com/apache/activemq/commit/22bc55b9487df98a3c3cb04f99f4618fcba364fe