CVE-2023-46604

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604

Remediation deadline: November 23, 2023

Ransomware use: Known

Description

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

Timeline

Published:November 2nd, 2023 12:00 AM

Last modified:November 2nd, 2023 12:00 AM

Added to KEV:November 2nd, 2023

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

Apache

Products

ActiveMQ

Weaknesses (CWE)

CWE-502

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute