CVE-2020-13920
Improper Authentication in Apache ActiveMQ
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- Record
CVE-2020-13920- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- Record
CVE-2020-13920- Updated
- 2026-11-02
EUVDEUVD-2022-1253 No score
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- Record
EUVD-2022-1253- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xgrx-xpv2-6vp4
Improper Authentication in Apache ActiveMQ
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- Record
GHSA-xgrx-xpv2-6vp4- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
OSV
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- Record
CVE-2020-13920- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-13920
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- Record
DEBIAN-CVE-2020-13920- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-xgrx-xpv2-6vp4
Improper Authentication in Apache ActiveMQ
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- Record
GHSA-xgrx-xpv2-6vp4- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-13920
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- Record
UBUNTU-CVE-2020-13920- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-activemq-2020-13920 No score
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- Record
BIT-activemq-2020-13920- Updated
- 2026-11-02
OSVUSN-6910-1 No score
activemq vulnerabilities
Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain commands. A remote attacker could possibly use this issue to terminate the program, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-7559)
Peter Stöckli discovered that Apache ActiveMQ incorrectly handled hostname verification. A remote attacker could possibly use this issue to perform a person-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-11775)
Jonathan Gallimore and Colm Ó hÉigeartaigh discovered that Apache ActiveMQ incorrectly handled authentication in certain functions. A remote attacker could possibly use this issue to perform a person-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-13920)
Gregor Tudan discovered that Apache ActiveMQ incorrectly handled LDAP authentication. A remote attacker could possibly use this issue to acquire unauthenticated access. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-26117)
It was discovered that Apache ActiveMQ incorrectly handled authentication. A remote attacker could possibly use this issue to run arbitrary code. (CVE-2022-41678)
It was discovered that Apache ActiveMQ incorrectly handled deserialization. A remote attacker could possibly use this issue to run arbitrary shell commands. (CVE-2023-46604)
- Record
USN-6910-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:activemq-parentMaven |
before 5.15.12 | 5.15.12 |
activemqBitnami |
before 5.15.12 | 5.15.12 |
activemqDebian:12 |
before 5.16.0-1 | 5.16.0-1 |
activemqDebian:13 |
before 5.16.0-1 | 5.16.0-1 |
activemqDebian:9 |
before 5.14.3-3+deb9u1, plus listed versions 5.14.3-3 |
5.14.3-3+deb9u1 |
activemqDebian:10 |
before 5.15.16-0+deb10u1, plus listed versions 5.15.10-15.15.11-15.15.8-25.15.9-1 |
5.15.16-0+deb10u1 |
org.apache.activemq:activemq-parentMaven |
before 5.15.12, plus listed versions 4.1.14.1.25.0.05.1.05.10.0 Show 45 moreShow less5.10.15.10.25.11.05.11.15.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.105.15.115.15.25.15.35.15.45.15.55.15.65.15.75.15.85.15.95.2.05.3.05.3.15.3.25.4.05.4.15.4.25.4.35.5.05.5.1 |
5.15.12 |
activemqUbuntu:Pro:16.04:LTS |
before 5.13.2+dfsg-2ubuntu0.1~esm1, plus listed versions 5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-2 |
5.13.2+dfsg-2ubuntu0.1~esm1 |
activemqUbuntu:Pro:18.04:LTS |
before 5.15.8-2~18.04.1~esm1, plus listed versions 5.14.5-35.15.2-25.15.3-25.15.8-2~18.04 |
5.15.8-2~18.04.1~esm1 |
activemqUbuntu:Pro:20.04:LTS |
before 5.15.11-1ubuntu0.1~esm1, plus listed versions 5.15.10-15.15.11-1 |
5.15.11-1ubuntu0.1~esm1 |
activemqUbuntu:Pro:22.04:LTS |
before 5.16.1-1ubuntu0.1~esm1, plus listed versions 5.16.1-1 |
5.16.1-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-13920 is a medium vulnerability (CVSS 5.9) in Apache Activemq, published September 10, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.54%, the 91st percentile. Fixed in org.apache.activemq:activemq-parent 5.15.12.
References
activemq.apache.org/security-advisories.data/CVE-2020-13920-announcement.txt
lists.debian.org/debian-lts-announce/2020/10/msg00013.html
oracle.com/security-alerts/cpuoct2020.html
lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-13920
github.com/apache/activemq/commit/359ae4b
issues.apache.org/jira/browse/AMQ-7400
security-tracker.debian.org/tracker/CVE-2020-13920
ubuntu.com/security/CVE-2020-13920
cve.org/CVERecord?id=CVE-2020-13920
Left out here: 5 versions. The JSON record has them.