{"id":"CVE-2022-41678","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-41678","generatedAt":"2026-11-04T22:43:12.060Z","title":"Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.","description":"Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. \n\nIn details, in ActiveMQ configurations, jetty allows\norg.jolokia.http.AgentServlet to handler request to /api/jolokia\n\norg.jolokia.http.HttpRequestHandler#handlePostRequest is able to\ncreate JmxRequest through JSONObject. And calls to\norg.jolokia.http.HttpRequestHandler#executeRequest.\n\nInto deeper calling stacks,\norg.jolokia.handler.ExecHandler#doHandleRequest can be invoked\nthrough refection. This could lead to RCE through via\nvarious mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.\n\n1 Call newRecording.\n\n2 Call setConfiguration. And a webshell data hides in it.\n\n3 Call startRecording.\n\n4 Call copyTo method. The webshell will be written to a .jsp file.\n\nThe mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.\nA more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.\n","published":"2023-11-28T16:15:07.000Z","lastModified":"2026-06-17T05:03:37.000Z","status":"Modified","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-287"],"affected":["apache/activemq"],"epss":{"score":0.8581,"percentile":0.99728,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 85.8%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt","tags":["Vendor Advisory"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl","tags":["Mailing List","Vendor Advisory"],"source":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20240216-0004/","source":"security@apache.org"},{"url":"https://www.openwall.com/lists/oss-security/2023/11/28/1","source":"security@apache.org"},{"url":"https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240216-0004/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openwall.com/lists/oss-security/2023/11/28/1","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-41678","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}