{"id":"CVE-2016-3088","aliases":["DEBIAN-CVE-2016-3088","EUVD-2022-5255","GHSA-rxqh-fc23-gxp2","UBUNTU-CVE-2016-3088"],"status":"published","title":"Improper Input Validation in Apache ActiveMQ","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.98365,"percentile":0.99918,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-434"],"published":"2016-06-01T20:00:00Z","modified":"2026-10-24T10:31:03Z","kev":{"date_added":"2022-02-10","due_date":"2022-08-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-02-10"},{"source":"kev","since":"2022-02-10"}],"exploits":[{"source":"exploitdb","id":"EDB-40857","title":"Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution","type":"remote","platform":"windows","date":"2015-08-17","verified":true,"url":"https://www.exploit-db.com/exploits/40857"},{"source":"metasploit","id":"exploit/multi/http/apache_activemq_upload_jsp","title":"ActiveMQ web shell upload","type":"exploit","platform":"Java,Linux,Windows","date":"2016-06-01","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/apache_activemq_upload_jsp"},{"source":"exploitdb","id":"EDB-42283","title":"ActiveMQ \u003c 5.14.0 - Web Shell Upload (Metasploit)","type":"remote","platform":"java","date":"2017-06-29","verified":true,"url":"https://www.exploit-db.com/exploits/42283"},{"source":"pocgithub","id":"Ma1Dong/ActiveMQ_putshell-CVE-2016-3088","title":"Ma1Dong/ActiveMQ_putshell-CVE-2016-3088","date":"2020-07-31","url":"https://github.com/Ma1Dong/ActiveMQ_putshell-CVE-2016-3088"},{"source":"pocgithub","id":"wood03mm/CVE-2016-3088","title":"wood03mm/CVE-2016-3088","date":"2020-12-24","url":"https://github.com/wood03mm/CVE-2016-3088"},{"source":"pocgithub","id":"cyberaguiar/CVE-2016-3088","title":"cyberaguiar/CVE-2016-3088","date":"2021-03-11","url":"https://github.com/cyberaguiar/CVE-2016-3088"},{"source":"pocgithub","id":"vonderchild/CVE-2016-3088","title":"vonderchild/CVE-2016-3088","date":"2021-03-12","url":"https://github.com/vonderchild/CVE-2016-3088"},{"source":"pocgithub","id":"cl4ym0re/CVE-2016-3088","title":"cl4ym0re/CVE-2016-3088","date":"2021-07-03","url":"https://github.com/cl4ym0re/CVE-2016-3088"},{"source":"pocgithub","id":"YutuSec/ActiveMQ_Crack","title":"YutuSec/ActiveMQ_Crack","date":"2022-04-02","url":"https://github.com/YutuSec/ActiveMQ_Crack"},{"source":"pocgithub","id":"HeArtE4t3r/CVE-2016-3088","title":"HeArtE4t3r/CVE-2016-3088","date":"2025-06-16","url":"https://github.com/HeArtE4t3r/CVE-2016-3088"},{"source":"pocgithub","id":"Catherines77/ActiveMQ-EXPtools","title":"Catherines77/ActiveMQ-EXPtools","date":"2026-04-20","url":"https://github.com/Catherines77/ActiveMQ-EXPtools"},{"source":"pocgithub","id":"CyberCTF/vulhub-activemq-cve-2016-3088","title":"CyberCTF/vulhub-activemq-cve-2016-3088","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-activemq-cve-2016-3088"},{"source":"nuclei","id":"CVE-2016-3088","title":"Apache ActiveMQ Fileserver - Arbitrary File Write","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3088.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-client","fixed_in":["5.14.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"activemq","fixed_in":["5.14.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"activemq","fixed_in":["5.14.0+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.14.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.14.0"}]}],"versions":["5.10.0","5.10.1","5.10.2","5.11.0","5.11.1","5.11.2","5.11.3","5.11.4","5.12.0","5.12.1","5.12.2","5.12.3","5.13.0","5.13.1","5.13.2","5.13.3","5.13.4","5.13.5","5.8.0","5.9.0","5.9.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0+dfsg1-4+deb8u1ubuntu1","5.6.0+dfsg1-5","5.13.2+dfsg-2","5.13.2+dfsg-2ubuntu0.1~esm1"]}],"products":[{"vendor":"apache","product":"activemq"}],"references":[{"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-356","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/42283/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-357","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2036.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securitytracker.com/id/1035951","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","fix","web"]},{"url":"https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","report","web"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3088","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a@%3Cusers.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/activemq/commit/3dd86d04e8b90ba309819317d19e7260d414d9e7","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/AMQ-6276","tags":["web"]},{"url":"https://stackoverflow.com/questions/67140241/configuring-activemq-webconsole-to-redirect-http-to-https","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/42283","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rxqh-fc23-gxp2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3088","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-3088","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3088","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-3088","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","status":"published","published":"2016-06-01T20:00:00Z","modified":"2025-10-21T23:55:51.892Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2022-5255","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","status":"published","published":"2016-06-01T20:00:00Z","modified":"2025-10-21T23:55:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-02-10","updated_at":"2026-11-02T19:49:39.684828Z"}],"ghsa":[{"id":"GHSA-rxqh-fc23-gxp2","title":"Improper Input Validation in Apache ActiveMQ","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","status":"published","published":"2022-05-14T01:14:51Z","modified":"2025-10-22T17:34:44Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-20","CWE-434"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2016-3088","title":"Apache ActiveMQ Improper Input Validation Vulnerability","description":"The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request","cwes":["CWE-20"],"kev":{"date_added":"2022-02-10","due_date":"2022-08-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2016-3088","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","status":"published","published":"2016-06-01T20:59:04.123Z","modified":"2026-06-17T00:44:56.753Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"CVE-2016-3088","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","status":"published","published":"2016-06-01T20:59:04.123Z","modified":"2026-10-24T10:31:03.596410436Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-3088","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","status":"published","published":"2016-06-01T20:59:04.123Z","modified":"2026-09-22T07:02:58.797001651Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-rxqh-fc23-gxp2","title":"Improper Input Validation in Apache ActiveMQ","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","status":"published","published":"2022-05-14T01:14:51Z","modified":"2025-10-22T19:25:16.159823Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-20","CWE-434"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"UBUNTU-CVE-2016-3088","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","status":"published","published":"2016-06-01T20:59:00Z","modified":"2025-09-08T16:43:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.872222Z"}]}}