high9.1
CVE-2024-51127
hornetq vulnerable to file overwrite, sensitive information disclosure
Impact
An issue in the `createTempFile` method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.hornetq:hornetq-core-client | <= 2.4.9 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Hornetq | through 2.4.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/JAckLosingHeart/CWE-378/blob/main/CVE-2024-51127.md
- https://github.com/advisories/GHSA-r7mv-mv7m-pjw3
- https://nvd.nist.gov/vuln/detail/CVE-2024-51127
- http://hornetq.com
- https://github.com/hornetq/hornetq/blob/HornetQ_2_4_9_Final/hornetq-core-client/src/main/java/org/hornetq/core/client/impl/ClientConsumerImpl.java#L665C35-L665C49