CVE-2023-46604 Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

🗓️ 27 Oct 2023 14:59:31Reported by apacheType

Unbounded deserialization vulnerability in Apache ActiveMQ Legacy OpenWire Modul

Reporter	Title	Published	Views	Family All 164
IBM Security Bulletins	Security Bulletin: IBM Sterling Transformation Extender is vulnerable to multiple issues due to Keycloak, Swagger UI, IBM GSKit, and Apache ActiveMQ	31 Jan 202413:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz for Service Management is vulnerable due to Log4j 1.2 SocketServer Remote Code Execution and Deserialization of Untrusted Data	24 Jun 202511:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache ActiveMQ affects App Connect Professional.	29 Dec 202307:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz for Service Management is vulnerable to remote code execution due to Apache ActiveMQ.	17 Jan 202405:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to remote code execution due to Apache ActiveMQ (CVE-2023-46604)	12 Dec 202316:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Command Center has addressed vulnerabilities IBM® Semeru Java™ Version 11, Apache ActiveMQ and Microsoft .Net MVC Framework for ASP.Net	28 Feb 202420:42	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache ActiveMQ affects IBM Operations Analytics Predictive Insights	14 Dec 202317:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to execute arbitrary code on the system [CVE-2023-46604]	14 Feb 202414:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	17 Oct 202400:20	–	ibm

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.activemq:activemq-client",
    "product": "Apache ActiveMQ",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.18.3",
        "status": "affected",
        "version": "5.18.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.17.6",
        "status": "affected",
        "version": "5.17.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.16.7",
        "status": "affected",
        "version": "5.16.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.15.16",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.activemq:activemq-openwire-legacy",
    "product": "Apache ActiveMQ Legacy OpenWire Module",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.18.3",
        "status": "affected",
        "version": "5.18.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.17.6",
        "status": "affected",
        "version": "5.17.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.16.7",
        "status": "affected",
        "version": "5.16.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.15.16",
        "status": "affected",
        "version": "5.8.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/10/27/5
activemq	www.activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
lists	www.lists.debian.org/debian-lts-announce/2023/11/msg00013.html
security	www.security.netapp.com/advisory/ntap-20231110-0010/
packetstormsecurity	www.packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
seclists	www.seclists.org/fulldisclosure/2024/Apr/18

11 Apr 2024 08:05Current

9.8High risk

Vulners AI Score9.8

CVSS 3.110

EPSS0.94436

CWE-502