GitStock

apache/activemq · Security

Apache ActiveMQ is vulnerable to Remote Code Execution

GHSA ID
GHSA-crg9-44h2-xw35
CVE ID
CVE-2023-46604
Severity
critical
Published
Updated
CVSS
10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:H
CVSS v3
10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:H

Description

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. 

Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

CWEs

  • CWE-502 · Deserialization of Untrusted Data

References

Open GitHub