NetSight
IP …
critical10.0Known exploited

CVE-2023-46604

Apache ActiveMQ is vulnerable to Remote Code Execution

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-11-02. Federal due date: 2023-11-23.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Impact

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.  Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.activemq:activemq-client< 5.15.165.15.16
mavenorg.apache.activemq:activemq-openwire-legacy>= 5.8.0, < 5.15.165.15.16

Affected products

VendorProductAffected versions
ApacheActivemq
before 5.15.16
from 5.16.0 before 5.16.7
from 5.17.0 before 5.17.6
from 5.18.0 before 5.18.3
ApacheActivemq Legacy Openwire Module
before 5.15.16
from 5.16.0 before 5.16.7
from 5.17.0 before 5.17.6
from 5.18.0 before 5.18.3
DebianDebian Linux
Versions 10.0, 11.0
NetappE-Series Santricity Unified Manager
All versions
NetappE-Series Santricity Web Services Proxy
All versions
NetappSantricity Storage Plugin
All versions

Weakness classification

CWE-502

References