CVE-2020-36282
9.8
CRITICAL · CVSS 3.1 · EPSS 2.8% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.84% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-502 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2021-03-12 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| rabbitmq | jms client |
References
- https://github.com/rabbitmq/rabbitmq-jms-client/issues/135
- https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2
- https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0
- https://medium.com/%40ramon93i7/a99645d0448b
- https://github.com/rabbitmq/rabbitmq-jms-client/issues/135
- https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2
- https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0
- https://medium.com/%40ramon93i7/a99645d0448b
→ the Explorer · watch your stack · NVD