All vulnerabilities
CVE-2023-46604

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Apache ActiveMQ
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationExploited in the wildAdded to KEV 2 Nov 2023. Known ransomware useCISA KEV
Exploit odds (EPSS)99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.18.3Also 5.17.6, 5.16.7 and 1 moreCVE List
Federal deadline23 Nov 2023Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

Show all 8 fixed versions
  • 5.16.7Apache ActiveMQ Legacy OpenWire ModuleCVE List
  • 5.15.16Apache ActiveMQ Legacy OpenWire ModuleCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 27 Oct 2023Exploit code publicMetasploit
  2. 27 Oct 2023, 14:59 UTCPublishedCVE List
  3. 2 Nov 2023Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Exploit moduleApache ActiveMQ Unauthenticated Remote Code Execution 27 Oct 2023Metasploit
  • Scanner templateApache ActiveMQ - Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

Text from CVE List

Affected versions 8

  • Apache ActiveMQaffected: 5.18.0 before 5.18.3CVE List
  • Apache ActiveMQaffected: 5.17.0 before 5.17.6CVE List
  • Apache ActiveMQaffected: 5.16.0 before 5.16.7CVE List
  • Apache ActiveMQaffected: all versions before 5.15.16CVE List
  • Apache ActiveMQ Legacy OpenWire Moduleaffected: 5.18.0 before 5.18.3CVE List
  • Apache ActiveMQ Legacy OpenWire Moduleaffected: 5.17.0 before 5.17.6CVE List
  • Apache ActiveMQ Legacy OpenWire Moduleaffected: 5.16.0 before 5.16.7CVE List
  • Apache ActiveMQ Legacy OpenWire Moduleaffected: 5.8.0 before 5.15.16CVE List

References 8