CVEvulnerability
CVE-2023-46604
CISA Known Exploited Vulnerability
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability — Apache ActiveMQ
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
- Added to KEV
- 2023-11-02
- Remediation due
- 2023-11-23
- Ransomware use
- Known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Notes
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604
- Status
- Analyzed
- Published
- 2023-10-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
Description
The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.
Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.
Affected configurations
• apache activemq (< 5.15.16)
• apache activemq (>= 5.16.0 < 5.16.7)
• apache activemq (>= 5.17.0 < 5.17.6)
• apache activemq (>= 5.18.0 < 5.18.3)
• apache activemq legacy openwire module (< 5.15.16)
• apache activemq legacy openwire module (>= 5.16.0 < 5.16.7)
• apache activemq legacy openwire module (>= 5.17.0 < 5.17.6)
• apache activemq legacy openwire module (>= 5.18.0 < 5.18.3)
• debian debian linux 10.0
• debian debian linux 11.0
• netapp e-series santricity unified manager
• netapp e-series santricity web services proxy
• netapp santricity storage plugin
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://seclists.org/fulldisclosure/2024/Apr/18 Mailing List, Third Party Advisory
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
- https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20231110-0010/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List
- http://seclists.org/fulldisclosure/2024/Apr/18 Mailing List, Third Party Advisory
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
- https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html Mailing List
- https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20231110-0010/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604 Third Party Advisory, US Government Resource