CVE-2017-15709 ActiveMQ's OpenWire protocol exposes certain system details as plain text

What is CVE-2017-15709?

CVE-2017-15709 is a low-severity vulnerability in Apache Activemq, published on 13 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.

Weakness: CWE-200

Which versions are affected by CVE-2017-15709?

6 open source packages ship an affected version, including org.apache.activemq:activemq-parent and org.apache.activemq:activemq-openwire-generator. It affects 1 product.

Products include Apache Activemq.

How do I fix CVE-2017-15709?

Upgrade org.apache.activemq:activemq-parent to a fixed version for your release line: 5.14.6 or 5.15.3.

Is CVE-2017-15709 being exploited?

There is no known exploitation of CVE-2017-15709 in the wild and no public exploit code.

Other vulnerabilities in Apache Activemq

• CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data Exploited Critical 10.0
• CVE-2016-3088 Apache ActiveMQ Improper Input Validation Exploited Critical 9.8
• CVE-2026-34197 Apache ActiveMQ Improper Input Validation Exploited High 8.8
• CVE-2020-11998 Remote code execution in Apache ActiveMQ Critical 9.8
• CVE-2013-7285 Command Injection in Xstream Critical 9.8

All Apache Activemq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-15709, GHSA-7qm4-p377-fr2r.