ActiveMQ OpenWire RCE (CVE-2023-46604)

Description

ActiveMQ has an OpenWire-protocol broker on TCP port 61616. It allows unauthenticated attackers to manipulate serialized class types leading to arbitrary code execution.

Remediation

Upgrade to the latest version of ActiveMQ

References

Update on CVE-2023-46604

Related Vulnerabilities

SSRF in Server-Side Rendering

WordPress 5.4.x Multiple Vulnerabilities (5.4 - 5.4.2)

XML external entity injection (variant)

Remote code execution of user-provided local names in Rails

WordPress Plugin Otter-Gutenberg Blocks-Page Builder for Gutenberg Editor & FSE PHAR Deserialization (2.2.5)

Severity

Critical

Classification

CVE-2023-46604 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H