Every CVESearch/Get API key

CVE-2015-1830

Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ

5.0 MediumPublic exploitFix available

CVE-2015-1830 is a medium vulnerability (CVSS 5.0) in Apache Activemq, published August 19, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 84.4%, the 99th percentile. Fixed in org.apache.activemq:activemq-client 5.11.2.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
84.4%EPSS, 99th percentile
Exploitation
None known3 public exploits
Fixed in
5.11.2org.apache.activemq:activemq-client +1 more

Description

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

Exploit likelihood

84.4%Up 1.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.activemq:activemq-client
Maven
5.0.0 to 5.11.1
5.11.2
org.apache.activemq:activemq-client
Maven
5.0.0 up to 5.11.2, plus listed versions
5.10.05.10.15.10.25.11.05.11.15.8.05.9.05.9.1
5.11.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution2015-08-17
MetasploitApache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload2015-08-19
Exploit-DBApache ActiveMQ 5.x-5.11.1 - Directory Traversal Shell Upload (Metasploit)2020-03-09

What each source reports

NVD Score used5.0

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

Record
CVE-2015-1830
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE ListNo score

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

Record
CVE-2015-1830
Updated
2026-11-02
EUVDEUVD-2022-2240No score

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

Record
EUVD-2022-2240
Updated
2026-11-03
GitHub AdvisoriesGHSA-3v63-f83x-37x4No score

Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

Record
GHSA-3v63-f83x-37x4
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-3v63-f83x-37x4No score

Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

Record
GHSA-3v63-f83x-37x4
Weakness
CWE-22
Updated
2026-11-02

History

History
RecordedChangedSources
exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 7 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open