Description

ActiveMQ has an OpenWire-protocol broker on TCP port 61616. It allows unauthenticated attackers to manipulate serialized class types leading to arbitrary code execution.

Remediation

Upgrade to the latest version of ActiveMQ

References

Update on CVE-2023-46604

Related Vulnerabilities

Oracle ADF Faces 'Miracle' RCE (CVE-2022-21445)

Sitecore XP Deserialization RCE (CVE-2021-42237)

Deserialization of Untrusted Data (Java JSON Deserialization) Jackson

node-serialize Insecure Deserialization

vBulletin PHP object injection vulnerability

Severity

Critical

Classification

CVE-2023-46604 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Tags

Insecure Deserialization Acumonitor