GitHub Advisoryadvisory · Maven

GHSA-crg9-44h2-xw35 Apache ActiveMQ is vulnerable to Remote Code Execution

CRITICAL Published 2023-10-27 Modified 2025-11-04 Official page ↗
Aliases
CVE-2023-46604
Ecosystem
Maven
Packages
org.apache.activemq:activemq-client, org.apache.activemq:activemq-openwire-legacy
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:H
Weaknesses
CWE-502
Reviewed
2023-10-30

Affected packages

• Maven org.apache.activemq:activemq-client: < 5.15.16 → fixed in 5.15.16 • Maven org.apache.activemq:activemq-client: >= 5.16.0, < 5.16.7 → fixed in 5.16.7 • Maven org.apache.activemq:activemq-client: >= 5.17.0, < 5.17.6 → fixed in 5.17.6 • Maven org.apache.activemq:activemq-client: >= 5.18.0, < 5.18.3 → fixed in 5.18.3 • Maven org.apache.activemq:activemq-openwire-legacy: >= 5.8.0, < 5.15.16 → fixed in 5.15.16 • Maven org.apache.activemq:activemq-openwire-legacy: >= 5.16.0, < 5.16.7 → fixed in 5.16.7 • Maven org.apache.activemq:activemq-openwire-legacy: >= 5.17.0, < 5.17.6 → fixed in 5.17.6 • Maven org.apache.activemq:activemq-openwire-legacy: >= 5.18.0, < 5.18.3 → fixed in 5.18.3

Description

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.  Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2023-46604 The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References