CVE-2023-46604

Apache ActiveMQ Deserialization of Untrusted Data

10.0 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 99.9%

Published27 Oct 2023
Added to CISA KEV2 Nov 2023
Remediation due23 Nov 2023

Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityLow

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Affected products

Apache Activemq≥ 5.16.0 < 5.16.7 · ≥ 5.17.0 < 5.17.6 · ≥ 5.18.0 < 5.18.3 · < 5.15.16

Apache Activemq Legacy Openwire Module≥ 5.16.0 < 5.16.7 · ≥ 5.17.0 < 5.17.6 · ≥ 5.18.0 < 5.18.3 · < 5.15.16

Netapp E-series Santricity Unified Managerall versions

Netapp E-series Santricity Web Services Proxyall versions

Netapp Santricity Storage Pluginall versions

Debian Linux10.0 · 11.0

Remediation

Fixed in

Apache Activemq≥ 5.16.7

Apache Activemq Legacy Openwire Module≥ 5.16.7

Patch & vendor advisories

https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

References

https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txtVendor Advisory
http://seclists.org/fulldisclosure/2024/Apr/18Mailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00013.htmlMailing List
https://lists.debian.org/debian-lts-announce/2024/10/msg00027.htmlMailing List
https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
https://security.netapp.com/advisory/ntap-20231110-0010/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604Third Party AdvisoryUS Government Resource
https://www.openwall.com/lists/oss-security/2023/10/27/5Mailing List

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2023-46604 being actively exploited?

Yes. CVE-2023-46604 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2 Nov 2023. It has been used in ransomware campaigns.

How severe is CVE-2023-46604?

CVE-2023-46604 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 99.9% probability of exploitation.

Which products are affected by CVE-2023-46604?

Affected products include Apache Activemq, Apache Activemq Legacy Openwire Module, Netapp E-series Santricity Unified Manager, Netapp E-series Santricity Web Services Proxy, Netapp Santricity Storage Plugin, and 1 more.

How do I fix CVE-2023-46604?

Upgrade affected software to a fixed version, for example Apache Activemq 5.16.7, Apache Activemq Legacy Openwire Module 5.16.7 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-46604 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.