CVE-2023-46604

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

En bref

Sévérité: CRITICAL 10.0
Exploitation: Exploitation connue (CISA KEV) · ajoutée le 2023-11-02
Exploitée selon l'ENISA depuis le 2023-11-02
EPSS: EPSS 99.89 % · centile 100 (2026-10-27)
État: PUBLISHED
Publiée: 2023-10-27
Mise à jour: 2025-11-03
Attribuée par: apache
Statut NVD: Analyzed

Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H	apache
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H	NVD · security@apache.org (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-502

Avis

GHSA-crg9-44h2-xw35 — Apache ActiveMQ is vulnerable to Remote Code Execution

Références européennes

ENISA EUVD · EUVD-2023-2719
GCVE · GCVE-0-2023-46604

Avis du CERT-FR

CERTFR-2024-AVI-0646 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0228 — Multiples vulnérabilités dans IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0180 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0090 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2023-AVI-1062 — Multiples vulnérabilités dans Juniper Secure Analytics · cert.ssi.gouv.fr
CERTFR-2023-AVI-1055 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2023-AVI-0919 — Vulnérabilité dans les produits SolarWinds · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* < 5.15.16
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* ≥ 5.16.0 < 5.16.7
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* ≥ 5.17.0 < 5.17.6
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* ≥ 5.18.0 < 5.18.3
cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* < 5.15.16
cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* ≥ 5.16.0 < 5.16.7
cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* ≥ 5.17.0 < 5.17.6
cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* ≥ 5.18.0 < 5.18.3
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:*

Produits affectés

Produit	Versions
Apache Software Foundation · Apache ActiveMQ	affected 5.18.0 < 5.18.3 ; affected 5.17.0 < 5.17.6 ; affected 5.16.0 < 5.16.7 ; affected 0 < 5.15.16
Apache Software Foundation · Apache ActiveMQ Legacy OpenWire Module	affected 5.18.0 < 5.18.3 ; affected 5.17.0 < 5.17.6 ; affected 5.16.0 < 5.16.7 ; affected 5.8.0 < 5.15.16

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD