Apache ActiveMQ Incomplete Authorization Vulnerability Allowing Destination Removal

A vulnerability exists in Apache ActiveMQ in versions prior to 5.19.7 and in the 6.0.0 series prior to 6.2.6. This vulnerability stems from incomplete authorization, which allows authenticated connections with the appropriate permissions to remove existing destinations. The issue is present in Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ, all within the specified version ranges.

Impact

Exploitation of this vulnerability could lead to unauthorized removal of destinations, potentially disrupting message routing and delivery in the ActiveMQ server.

Remediation

Users are advised to upgrade to Apache ActiveMQ version 6.2.6 or 5.19.7, both of which address this vulnerability.