View all vulnerabilities

CVE-2023-46604

Apache ActiveMQ is vulnerable to Remote Code Execution

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
10
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Affected Versions
org.apache.activemq:activemq-client < 5.15.16; org.apache.activemq:activemq-client >= 5.16.0 < 5.16.7; org.apache.activemq:activemq-client >= 5.17.0 < 5.17.6; org.apache.activemq:activemq-client >= 5.18.0 < 5.18.3; org.apache.activemq:activemq-openwire-legacy >= 5.8.0 < 5.15.16; org.apache.activemq:activemq-openwire-legacy >= 5.16.0 < 5.16.7; org.apache.activemq:activemq-openwire-legacy >= 5.17.0 < 5.17.6; org.apache.activemq:activemq-openwire-legacy >= 5.18.0 < 5.18.3
Severity
Ecosystem
Publish Date
October 27, 2023
Modified Date
February 13, 2025