Advisory details:
vulnrichment / CVE-2023-46604
| Advisory ID | vulnrichment/CVE-2023-46604 |
| Aliases | |
| Summary | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 10 | |
| ssvc | Act |
| Reference id | Reference type | URL |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html | ||
| https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html | ||
| https://www.openwall.com/lists/oss-security/2023/10/27/5 | ||
| 18 | Other | http://seclists.org/fulldisclosure/2024/Apr/18 |
| CVE-2023-46604-ANNOUNCEMENT.TXT | https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt | |
| ntap-20231110-0010 | Other | https://security.netapp.com/advisory/ntap-20231110-0010/ |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a deserialization vulnerability in the OpenWire transport unmarshaller in Apache ActiveMQ. Affected versions include 5.18.0 through to 5.18.2, 5.17.0 through to 5.17.5, 5.16.0 through to 5.16.6, and all versions before 5.15.16. |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 27, 2023 |
| Platform | Linux,Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb |
| Data source | KEV |
|---|---|
| Date added | Nov. 2, 2023 |
| Description | Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
| Due date | Nov. 23, 2023 |
| Note | https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604 |
| Ransomware campaign use | Known |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T15:16:07Z/
Decision: Act
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2023/46xxx/CVE-2023-46604.json
Source Advisory: vulnrichment/CVE-2023-46604
[{'Exploitation': 'active'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]