CVE-2018-11775
UnknownEPSS 6.99%
Last modified
CVE-2018-11775 is a vulnerability of currently unknown severity. TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.. EPSS estimates a 6.99% chance of exploitation in the next 30 days.
Description
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Activemq | < 5.15.6 |
| Oracle | Enterprise Repository | 12.1.3.0.0 |
| Oracle | Flexcube Private Banking | 2.0.0.0 |
| Oracle | Flexcube Private Banking | 2.2.0.1 |
| Oracle | Flexcube Private Banking | 12.0.1.0 |
| Oracle | Flexcube Private Banking | 12.0.3.0 |
| Oracle | Flexcube Private Banking | 12.1.0.0 |
References
- http://www.securityfocus.com/bid/105335Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041618Third Party Advisory, VDB Entry
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/105335Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041618Third Party Advisory, VDB Entry
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-11775?
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
How severe is CVE-2018-11775?
Severity scoring for CVE-2018-11775 is pending analysis. The EPSS model estimates a 6.99% probability of exploitation in the next 30 days.
How do I fix CVE-2018-11775?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-1177This vulnerability allows remote attackers to execute arbitr…
- CVE-2018-11770From version 1.3.0 onward, Apache Spark's standalone master …4.2
- CVE-2018-11771When reading a specially crafted ZIP archive, the read metho…5.5
- CVE-2018-11772Apache VCL versions 2.1 through 2.5 do not properly validate…
- CVE-2018-11773Apache VCL versions 2.1 through 2.5 do not properly validate…
- CVE-2018-11774Apache VCL versions 2.1 through 2.5 do not properly validate…
- CVE-2018-11776Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffe…8.1
- CVE-2018-11777In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on …
- CVE-2018-11778UnixAuthenticationService in Apache Ranger 1.2.0 was updated…
- CVE-2018-11779In Apache Storm versions 1.1.0 to 1.2.2, when the user is us…
- CVE-2018-1178This vulnerability allows remote attackers to execute arbitr…
- CVE-2018-11780A potential Remote Code Execution bug exists with the PDFInf…
Are you affected by CVE-2018-11775?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST