This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Apache fixes a critical vulnerability in ActiveMQ

Apache fixes a critical vulnerability in the ActiveMQ product.

CVE-2023-46604 - ActiveMQ RCE
CVSS 10.0 (Critical)

Due to deserialization on the vulnerable device, an unauthenticated remote attacker can execute shell commands [1]. A public PoC is available for the vulnerability [2]. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog [3]. Impact: Malicious code execution affecting overall confidentiality, integrity, and availability of the system Recommendations: The vulnerability is fixed in versions 5.15.16, 5.16.7, 5.17.6 and 5.18.3 [1].

The vulnerability is present in products:

  • Apache ActiveMQ; >=5.18.0, <5.18.3; >=5.17.0, <5.17.6; >=5.16.0, <5.16.7; >=0, <5.15.16
  • Apache InActive; >=4.0, <4.5.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

More information:

The vulnerability was publicly disclosed 27. 10. 2023. This report was last updated 28. 10. 2023.

By CESNET, z.s.p.o. Martin Krajči on 6. 11. 2023.

CESNET, z.s.p.o. Logo