{"schemaVersion":3,"id":"CVE-2023-46604","aliases":["UBUNTU-CVE-2023-46604","DEBIAN-CVE-2023-46604","GHSA-crg9-44h2-xw35","BIT-activemq-2023-46604"],"status":"published","duplicateOf":null,"title":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code\nExecution. This vulnerability may allow a remote attacker with network\naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire\nprotocol to cause either the client or the broker (respectively) to\ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3\nwhich fixes this issue.","dates":{"published":"2023-10-27T14:59:31.046Z","modified":"2025-11-03T21:50:00.516Z","reserved":null,"kevAdded":["2023-11-02T00:00:00.000Z","2025-01-23T00:00:00.000Z"],"kevDue":["2023-11-23T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:H","exploitability":10,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99891,"percentile":0.99965,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.16800000000000148,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.99723},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99891,"percentile":0.99965}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99723,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99891,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99891,"percentile":0.99965}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2023-11-02T00:00:00.000Z","dueDate":"2023-11-23T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","description":"Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.","notes":[{"type":"url","href":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt","label":"activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2023-46604","label":"nvd.nist.gov/vuln/detail/CVE-2023-46604"}],"vendor":"Apache","product":"ActiveMQ","ransomware":true,"ransomwareUse":"Known","exploitationType":null},{"source":"enisa","sourceLabel":"ENISA","dateAdded":"2025-01-23T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":"RCE vulnerability that allows remote attackers with network access to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath","notes":[],"vendor":"Apache","product":"ActiveMQ","ransomware":true,"ransomwareUse":"Known","exploitationType":"ransomware"}],"listedCount":2,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2023-11-02T00:00:00.000Z","dueDate":"2023-11-23T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","description":"Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.","notes":[{"type":"url","href":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt","label":"activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2023-46604","label":"nvd.nist.gov/vuln/detail/CVE-2023-46604"}],"vendor":"Apache","product":"ActiveMQ","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":true,"entry":{"source":"enisa","sourceLabel":"ENISA","dateAdded":"2025-01-23T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":"RCE vulnerability that allows remote attackers with network access to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath","notes":[],"vendor":"Apache","product":"ActiveMQ","ransomware":true,"ransomwareUse":"Known","exploitationType":"ransomware"}},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa","enisa"]},"exploits":[{"id":"REF_9B4FDE6FECCA99BE","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_EXPLOIT_MULTI_MISC_APACHE_ACTIVEMQ_RCE_CVE_2023_46604","name":"Apache ActiveMQ Unauthenticated Remote Code Execution","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/multi/misc/apache_activemq_rce_cve_2023_46604.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/multi/misc/apache_activemq_rce_cve_2023_46604","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs"],"reliability":["repeatable-session"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/502.html"}],"affected":[{"vendor":"apache software foundation","product":"apache activemq","name":"Apache ActiveMQ","label":"apache activemq","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.18.0, < 5.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.17.0, < 5.17.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.16.0, < 5.16.7","noFixRecorded":false,"fixedIn":null},{"text":"< 5.15.16","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.18.0, < 5.18.3 | ≥ 5.17.0, < 5.17.6 | ≥ 5.16.0, < 5.16.7 | < 5.15.16","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_activemq"},{"vendor":"apache software foundation","product":"apache activemq legacy openwire module","name":"Apache ActiveMQ Legacy OpenWire Module","label":"apache activemq legacy openwire module","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.18.0, < 5.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.17.0, < 5.17.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.16.0, < 5.16.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.8.0, < 5.15.16","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.18.0, < 5.18.3 | ≥ 5.17.0, < 5.17.6 | ≥ 5.16.0, < 5.16.7 | ≥ 5.8.0, < 5.15.16","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_activemq_legacy_openwire_module"},{"vendor":"apache","product":"activemq","name":"ActiveMQ","label":"activemq","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.15.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.16.0, < 5.16.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.17.0, < 5.17.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.18.0, < 5.18.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.15.16 | ≥ 5.16.0, < 5.16.7 | ≥ 5.17.0, < 5.17.6 | ≥ 5.18.0, < 5.18.3","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"apache-activemq","label":"Apache ActiveMQ Classic","category":"server-app"}},"hubHref":"/vendor/apache/activemq"},{"vendor":"apache","product":"activemq_legacy_openwire_module","name":"activemq legacy openwire module","label":"activemq_legacy_openwire_module","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.15.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.16.0, < 5.16.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.17.0, < 5.17.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.18.0, < 5.18.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.15.16 | ≥ 5.16.0, < 5.16.7 | ≥ 5.17.0, < 5.17.6 | ≥ 5.18.0, < 5.18.3","eol":null,"hubHref":"/vendor/apache/activemq_legacy_openwire_module"},{"vendor":"debian","product":"activemq","name":"activemq","label":"activemq","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/activemq","purlType":"deb","versions":[{"text":"< 5.17.2+dfsg-2+deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"< 5.17.6+dfsg-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.17.2+dfsg-2+deb12u1 | < 5.17.6+dfsg-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"activemq","name":"activemq","label":"activemq","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/activemq","purlType":"deb","versions":[{"text":"< 5.13.2+dfsg-2ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 5.15.8-2~18.04.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 5.15.11-1ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 5.16.1-1ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 5.16.1-1ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.13.2+dfsg-2ubuntu0.1~esm1 | < 5.15.8-2~18.04.1~esm1 | < 5.15.11-1ubuntu0.1~esm1 | < 5.16.1-1ubuntu0.1 | < 5.16.1-1ubuntu0.1~esm1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"10.0","noFixRecorded":false,"fixedIn":null},{"text":"11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.0 | 11.0","eol":{"isEol":true,"eolDate":"2024-06-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"10","label":"10 (Buster)","eolFrom":"2024-06-30T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"10.13"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"org.apache.activemq","product":"activemq-client","name":"org.apache.activemq:activemq-client","label":"activemq-client","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.activemq/activemq-client","purlType":"maven","versions":[{"text":"< 5.15.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.16.0, < 5.16.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.17.0, < 5.17.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.18.0, < 5.18.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.15.16 | ≥ 5.16.0, < 5.16.7 | ≥ 5.17.0, < 5.17.6 | ≥ 5.18.0, < 5.18.3","eol":null,"hubHref":null},{"vendor":"org.apache.activemq","product":"activemq-openwire-legacy","name":"org.apache.activemq:activemq-openwire-legacy","label":"activemq-openwire-legacy","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.activemq/activemq-openwire-legacy","purlType":"maven","versions":[{"text":"≥ 5.8.0, < 5.15.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.16.0, < 5.16.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.17.0, < 5.17.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.18.0, < 5.18.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.8.0, < 5.15.16 | ≥ 5.16.0, < 5.16.7 | ≥ 5.17.0, < 5.17.6 | ≥ 5.18.0, < 5.18.3","eol":null,"hubHref":null},{"vendor":"netapp","product":"e-series_santricity_unified_manager","name":"e-series santricity unified manager","label":"e-series_santricity_unified_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/e-series_santricity_unified_manager"},{"vendor":"netapp","product":"e-series_santricity_web_services_proxy","name":"e-series santricity web services proxy","label":"e-series_santricity_web_services_proxy","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/e-series_santricity_web_services_proxy"},{"vendor":"netapp","product":"santricity_storage_plugin","name":"santricity storage plugin","label":"santricity_storage_plugin","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/santricity_storage_plugin"}],"affectedCount":12,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt","label":"activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt","hostname":"activemq.apache.org","tags":["Vendor Advisory","REPORT","WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2023/10/27/5","label":"www.openwall.com/lists/oss-security/2023/10/27/5","hostname":"www.openwall.com","tags":["WEB","Mailing List"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0010/","label":"security.netapp.com/advisory/ntap-20231110-0010/","hostname":"security.netapp.com","tags":["Third Party Advisory"]},{"url":"https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","label":"packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","hostname":"packetstormsecurity.com","tags":["WEB","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html","label":"lists.debian.org/debian-lts-announce/2023/11/msg00013.html","hostname":"lists.debian.org","tags":["WEB","Mailing List"]},{"url":"http://seclists.org/fulldisclosure/2024/Apr/18","label":"seclists.org/fulldisclosure/2024/Apr/18","hostname":"seclists.org","tags":["WEB","Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html","label":"lists.debian.org/debian-lts-announce/2024/10/msg00027.html","hostname":"lists.debian.org","tags":["WEB","Mailing List"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604","hostname":"www.cisa.gov","tags":["Government Resource","WEB","Third Party Advisory","US Government Resource"]},{"url":"https://ubuntu.com/security/CVE-2023-46604","label":"ubuntu.com/security/CVE-2023-46604","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/27/5","label":"www.openwall.com/lists/oss-security/2023/10/27/5","hostname":"www.openwall.com","tags":["REPORT","WEB"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46604","label":"www.cve.org/CVERecord?id=CVE-2023-46604","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-6910-1","label":"ubuntu.com/security/notices/USN-6910-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7268-1","label":"ubuntu.com/security/notices/USN-7268-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46604","label":"security-tracker.debian.org/tracker/CVE-2023-46604","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46604","label":"nvd.nist.gov/vuln/detail/CVE-2023-46604","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/activemq/pull/1098","label":"github.com/apache/activemq/pull/1098","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/activemq/commit/22442b2385b1000312aec3d19e510131d595a5fc","label":"github.com/apache/activemq/commit/22442b2385b1000312aec3d19e510131d595a5fc","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/activemq/commit/80089f9f476afab7d976f5fc37c5ab4aa0c2139d","label":"github.com/apache/activemq/commit/80089f9f476afab7d976f5fc37c5ab4aa0c2139d","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/activemq/commit/958330df26cf3d5cdb63905dc2c6882e98781d8f","label":"github.com/apache/activemq/commit/958330df26cf3d5cdb63905dc2c6882e98781d8f","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/activemq/commit/9905e2a5bf9862a049f94ce0a2465b0c7ad52436","label":"github.com/apache/activemq/commit/9905e2a5bf9862a049f94ce0a2465b0c7ad52436","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/activemq/commit/d0ccdd31544ada83185554c87c7aa141064020f0","label":"github.com/apache/activemq/commit/d0ccdd31544ada83185554c87c7aa141064020f0","hostname":"github.com","tags":["WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0010","label":"security.netapp.com/advisory/ntap-20231110-0010","hostname":"security.netapp.com","tags":["WEB"]},{"url":"https://issues.apache.org/jira/browse/AMQ-9370","label":"issues.apache.org/jira/browse/AMQ-9370","hostname":"issues.apache.org","tags":["WEB"]},{"url":"https://github.com/apache/activemq","label":"github.com/apache/activemq","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604","label":"activemq.apache.org/security-advisories.data/CVE-2023-46604","hostname":"activemq.apache.org","tags":["WEB"]},{"url":"http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","label":"packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html","hostname":"packetstormsecurity.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["DLA-3657-1","DLA-3936-1","DSA-5798-1","USN-6910-1","USN-7268-1"],"duplicates":[],"related":["USN-6910-1","USN-7268-1"]},"timeline":[{"kind":"published","date":"2023-10-27T14:59:31.046Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2023-11-02T00:00:00.000Z","label":"Added to CISA KEV","detail":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2023-11-23T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","source":"cisa"},{"kind":"kev-added","date":"2025-01-23T00:00:00.000Z","label":"Added to ENISA KEV","detail":"Added to the ENISA known exploited vulnerabilities catalog.","source":"enisa"},{"kind":"modified","date":"2025-11-03T21:50:00.516Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":100,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T19:07:05.106Z","stale":false,"partial":false}}