ZeroDay Findings
Sign inSign up

Findings

CVE-2016-3088

Apache ActiveMQ Improper Input Validation Vulnerability

Published Jun 1, 2016 · updated Jun 16, 2026 · apache activemq

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 1, 2016 · Catalog

    Detected

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

  2. Feb 10, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Aug 10, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Required action

Apply updates per vendor instructions.

CISA due date Aug 10, 2022

Affected

  • cpe apache/activemqversion unspecified
  • vendor Apache ActiveMQversion unspecified

Sources

  • CISA KEVCVE-2016-3088

    The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

    cisa.gov
  • CVE.orgCVE-2016-3088

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2016-3088

    30-day exploitation probability 98.5%

    first.org
  • Exploit Database40857

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database42283

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/apache_activemq_upload_jsp

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2016-3088

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

    nvd.nist.gov

References