---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Required jms connection factories \[New in Security Center 1.3 and updated in 1.5 and 2.0\]

# Required jms connection factories \[New in Security Center 1.3 and updated in 1.5 and
2.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

The mid.property.jms.command.allowed_factory_names property controls the Java Messaging Service (JMS) connection factories that the MID Server can use.
It is intended for a few select factories needed by plugins for JMS activity or action. Including additional factories could be a step in a chain of attack for vulnerabilities such as JDNI insertion that rely on capabilities an
attacker can leverage in allowed factories. To prevent the possibility of any leveraged vulnerability, do not include factories beyond the necessary defaults.

To remediate this security risk review the list of names provided to the mid property, mid.property.jms.command.allowed_factory_names. Ensure any additional Java factory names beyond the default of
connectionFactory, queueConnectionFactory, and topicConnectionFactory are necessary.

## More information {#sc-required-jms-connection-factories-plugin-applicability-mid-server__section_qhx_1b1_xwb}

{#sc-required-jms-connection-factories-plugin-applicability-mid-server__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | mid.property.jms.command.allowed_factory_names |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | string |
| Default value | connectionFactory, queueConnectionFactory, topicConnectionFactory |
| Recommended value | connectionFactory, queueConnectionFactory, topicConnectionFactory |
| Category | [Access control](https://servicenow-prod.fluidtopics.net/xAmazkRh5FKyeb7q4TQGWw "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 4.1 * CVSS score: Medium * Security risk details: If the MID Server (com.glideapp.agent) plugin is active, review the list of names provided to the mid property mid.property.jms.command.allowed_factory_names. Ensure any additional factory names beyond the default of connectionFactory, queueConnectionFactory, and topicConnectionFactory are necessary. {#sc-required-jms-connection-factories-plugin-applicability-mid-server__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-required-jms-connection-factories-plugin-applicability-mid-server__table_ajc_b43_3kb}