CVE-2023-46604: Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
In CISA’s Known Exploited Vulnerabilities catalog: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability.
Added , federal remediation due . Known ransomware use: Known.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H · CWE-502
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
Apache Software Foundation: Apache ActiveMQApache Software Foundation: Apache ActiveMQ Legacy OpenWire Module
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt (opens in new tab)
- seclists.org/fulldisclosure/2024/Apr/18 (opens in new tab)
- lists.debian.org/debian-lts-announce/2023/11/msg00013.html (opens in new tab)
- packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.ht… (opens in new tab)
- security.netapp.com/advisory/ntap-20231110-0010/ (opens in new tab)
- www.openwall.com/lists/oss-security/2023/10/27/5 (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)