cve.report Open in urlscan Pro
2606:4700:3108::ac42:287a  Public Scan

Form analysis
1 forms found in the DOM

GET ../../../search.php

<form action="../../../search.php" method="get" target="blank">
  <div class="form-group">
    <input type="text" class="form-control" id="search" name="search" title="CVE.report Search" placeholder="CVE.report Search">
  </div>
</form>

Text Content

Toggle navigation
 * Home




CVE-2023-46604

Published on: Not Yet Published

Last Modified on: 10/27/2023 06:07:31 PM UTC

CVE-2023-46604

Source: Mitre Source: NIST CVE.ORG Print: PDF

Certain versions of Apache ActiveMQ from Apache Software Foundation contain the
following vulnerability:

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may
allow a remote attacker with network access to a broker to run arbitrary shell
commands by manipulating serialized class types in the OpenWire protocol to
cause the broker to instantiate any class on the classpath.  Users are
recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which
fixes this issue.

 * CVE-2023-46604 has been assigned by security@apache.org to track the
   vulnerability


CVE REFERENCES

Description Tags ⓘ Link activemq.apache.org
text/plain
MISC
activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txtoss-security
- CVE-2023-46604: Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module:
Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code
execution (RCE) attack www.openwall.com
text/html
MISC www.openwall.com/lists/oss-security/2023/10/27/5

By selecting these links, you may be leaving CVEreport webspace. We have
provided these links to other websites because they may have information that
would be of interest to you. No inferences should be drawn on account of other
sites being referenced, or not, from this page. There may be other websites that
are more appropriate for your purpose. CVEreport does not necessarily endorse
the views expressed, or concur with the facts presented on these sites. Further,
CVEreport does not endorse any commercial products that may be mentioned on
these sites. Please address comments about any linked pages to
comment@cve.report.
There are currently no QIDs associated with this CVE


KNOWN AFFECTED SOFTWARE

Vendor Product Version Apache Software Foundation Apache_ActiveMQ< 5.18.3 Apache
Software Foundation Apache_ActiveMQ< 5.17.6 Apache Software Foundation
Apache_ActiveMQ< 5.16.7 Apache Software Foundation Apache_ActiveMQ< 5.15.16
Apache Software Foundation Apache_ActiveMQ_Legacy_OpenWire_Module< 5.18.3 Apache
Software Foundation Apache_ActiveMQ_Legacy_OpenWire_Module< 5.17.6 Apache
Software Foundation Apache_ActiveMQ_Legacy_OpenWire_Module< 5.16.7 Apache
Software Foundation Apache_ActiveMQ_Legacy_OpenWire_Module< 5.15.16

No vendor comments have been submitted for this CVE
 * ← Previous ID
 * Next ID→

© CVE.report 2023 |

Use of this information constitutes acceptance for use in an AS IS condition.
There are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. It is the
responsibility of user to evaluate the accuracy, completeness or usefulness of
any information, opinion, advice or other content. EACH USER WILL BE SOLELY
RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this
web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will
NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the
authoritative source of CVE content is MITRE's CVE web site. This site includes
MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report