activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

A flaw was found in Apache ActiveMQ, specifically the OpenWire Module. This flaw may allow a remote malicious user to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol, causing the broker to instantiate any class on the classpath. This issue happens when...

Apache ActiveMQ Unauthenticated Remote Code Execution

This module exploits a deserialization vulnerability in the OpenWire transport unmarshaller in Apache ActiveMQ. Affected versions include 5.18.0 through to 5.18.2, 5.17.0 through to 5.17.5, 5.16.0 through to 5.16.6, and all versions before 5.15.16. Module Options msf use...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 This repository contains an exploit script and...

Apache ActiveMQ vulnerability used in ransomware attacks

On the 27 October, the Apache Software Foundation ASF announced a very serious vulnerability in Apache ActiveMQ that can be used to achieve remote code execution RCE. The Cybersecurity and Infrastructure Security Agency has now added this vulnerability to its Known Exploited Vulnerabilities...

OESA-2023-1778 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized clas...

VulnCheck KEV: CVE-2023-46604

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath...

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath...

Apache ActiveMQ < 5.15.16 / 5.16.x < 5.16.7 / 5.17.x < 5.17.6 / 5.18.x < 5.18.3 RCE

Apache ActiveMQ is vulnerable to remote code execution. The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. User...

The vulnerability of the Apache ActiveMQ software platform, related to the restoration of unreliable data in memory, allows a hacker to execute arbitrary code.

The vulnerability of the Apache ActiveMQ software platform lies in the recovery of unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code by creating a class based on the OpenWire protocol...

CVE-2023-46604

A flaw was found in Apache ActiveMQ, specifically the OpenWire Module. This flaw may allow a remote malicious user to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol, causing the broker to instantiate any class on the classpath. This issue happens when...

Remote Code Execution

activemq is vulnerable to Remote Code Execution. The vulnerability is due to BaseDataStreamMarshaller.java as there is no class validation and does not verify that the loaded class is a valid Throwable. This allows an attacker to manipulate serialized class types within the OpenWire protocol,...

Apache ActiveMQ Deserialization Vulnerability

Apache ActiveMQ is the United States Apache Apache Foundation of a set of open source messaging middleware , which supports Java messaging services , clustering , Spring Framework and so on. Apache ActiveMQ there is a deserialization vulnerability , the vulnerability stems from the application in...

be.yildiz-games:module-messaging-activemq (=1.0.14), ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0 <=2.2.0) +298 more potentially affected by CVE-2023-46604 via org.apache.activemq:activemq-openwire-legacy (>=5.16.0 <=5.16.6)

org.apache.activemq:activemq-openwire-legacy MAVEN version =5.16.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3.0, =2.3.0, =2.3.0, =2.3.0, =1.6.0, =1.4.6, =0.1.10, =1.4.6, =1.4.6, =1.5.4 and more Source cves: CVE-2023-46604 Source advisory: OSV:GHSA-CRG9-44H2-XW35...

com.chutneytesting:action-impl (>=2.2.1 <=2.5.1), com.chutneytesting:chutney-junit-engine (>=2.2.1 <=2.5.1) +37 more potentially affected by CVE-2023-46604 via org.apache.activemq:activemq-openwire-legacy (>=5.18.0 <=5.18.2)

org.apache.activemq:activemq-openwire-legacy MAVEN version =5.18.0, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =RC0-0.19.12-2023-10-27, =RC0-0.19.12-2023-10-27, =RC0-0.19.12-2023-10-27, =RC0-0.19.12-2023-10-27, =2.19.1, =5.18.0, =5.18.0, =5.18.0, =5.18.0, =5.18.0, =5.18.0, =5.18.2 and more Source cves:...

GHSA-CRG9-44H2-XW35 Apache ActiveMQ is vulnerable to Remote Code Execution

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. Users...

com.chutneytesting:chutney-kotlin-dsl (>=0.1.18 <=1.0.1), com.codbex.aion:codbex-aion-platform (>=0.5.6 <=0.5.7) +150 more potentially affected by CVE-2023-46604 via org.apache.activemq:activemq-openwire-legacy (>=5.17.0 <=5.17.5)

org.apache.activemq:activemq-openwire-legacy MAVEN version =5.17.0, =0.1.18, =0.5.6, =0.5.6, =0.5.6, =0.3.0, =0.3.0, =0.5.3, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.4.0 and more Source cves: CVE-2023-46604 Source advisory:...

Apache ActiveMQ is vulnerable to Remote Code Execution

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. Users...

CVE-2023-46604

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to caus...

DEBIAN-CVE-2023-46604

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to caus...

CVE-2023-46604

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to caus...