CVE-2023-46604 — Vulnerability intelligence

Apache — ActiveMQ

Published: 2023-10-27T14:59:31.046Z

CVSS

10

CISA KEV

Known exploitation

Original source text (not a translation)

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

Sources

• Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
• Original advisory
• Original advisory
• CVE-2023-46604