Known Exploited Vulnerability
10.0
CRITICAL
CVE-2023-46604
Apache ActiveMQ Deserialization of Untrusted Data - [Actively Exploited]
Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

INFO

Published Date :

Oct. 27, 2023, 3:15 p.m.

Last Modified :

Feb. 13, 2025, 6:15 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

6.0

Exploitability Score :

3.9
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604

Public PoC/Exploit Available at Github

CVE-2023-46604 has a 73 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2023-46604 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Netapp e-series_santricity_unified_manager
2 Netapp e-series_santricity_web_services_proxy
3 Netapp santricity_storage_plugin
1 Apache activemq
2 Apache activemq_legacy_openwire_module
1 Debian debian_linux
: Total Affected Vendor : 3 | Products : 6
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2023-46604.

URL Resource
http://seclists.org/fulldisclosure/2024/Apr/18 Mailing List Third Party Advisory
https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20231110-0010/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List
http://seclists.org/fulldisclosure/2024/Apr/18 Mailing List Third Party Advisory
https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20231110-0010/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
amnaamjid/IS-825-Vulnerability-Exploitation-Defence

None

Updated: 1 month ago
0 stars 0 fork 0 watcher
Born at : July 2, 2025, 6:16 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
erickrr-bd/PoC-CVE

Proof of concept (PoC) repository for specific CVEs.

Dockerfile Python Java Classic ASP

Updated: 4 days ago
0 stars 1 fork 1 watcher
Born at : June 25, 2025, 5:09 p.m. This repo has been linked 3 different CVEs too.
Profile Photo
cc8700619/poc

None

Updated: 1 month, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : June 10, 2025, 6:57 a.m. This repo has been linked 105 different CVEs too.
Profile Photo
Linathimqalo/cloud-honeypot-analysis

A comparative cloud honeypot project that utilises google cloud platform and microsoft azure.

Updated: 2 months ago
0 stars 0 fork 0 watcher
Born at : June 1, 2025, 11:43 a.m. This repo has been linked 7 different CVEs too.
Profile Photo
hdgokani/Golangexploit

None

Go PHP JavaScript Groovy Java Python VBScript

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : May 8, 2025, 10:43 a.m. This repo has been linked 5 different CVEs too.
Profile Photo
CCIEVoice2009/CVE-2023-46604

None

Python Shell

Updated: 2 months, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : May 4, 2025, 2:42 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
myonggyu/whs

None

Python

Updated: 3 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : April 17, 2025, 7:04 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
g1san/Agents-for-Vulnerable-Dockers-and-related-Benchmarks

This thesis project focuses on the creation of an autonomous agent that is capable of understanding CVE description and create from its interpretation a vulnerable Docker container, which can then be used to gather attack patterns data. The Docker creation process is benchmarked in order to understand how well the agent is performing its tasks.

Dockerfile HTML Python Shell Groovy PHP

Updated: 4 days, 12 hours ago
0 stars 0 fork 0 watcher
Born at : April 1, 2025, 1:35 p.m. This repo has been linked 115 different CVEs too.
Profile Photo
Charlemagne-ai/aws-tpot-honeypot

None

Updated: 4 months ago
0 stars 0 fork 0 watcher
Born at : March 9, 2025, 7:32 p.m. This repo has been linked 4 different CVEs too.
Profile Photo
skrkcb2/CVE-2023-46604

None

Updated: 5 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Feb. 27, 2025, 2:49 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
TheOffender/dock-n-pwn

A modular, dockerized pentesting environment

Shell PHP Python Dockerfile Java Groovy HTML Ruby CSS JavaScript

Updated: 5 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Feb. 24, 2025, 5:19 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
hungnqdz/cve

None

Shell Dockerfile Makefile C Java HTML Python Visual Basic 6.0 VBA PLSQL

Updated: 3 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Feb. 21, 2025, 9:34 a.m. This repo has been linked 4 different CVEs too.
Profile Photo
plzheheplztrying/cve_monitor

None

HTML Python Shell

Updated: 4 weeks, 2 days ago
0 stars 0 fork 0 watcher
Born at : Feb. 13, 2025, 8:50 a.m. This repo has been linked 891 different CVEs too.
Profile Photo
skrkcb2/Secure

portfolio

Updated: 5 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Jan. 16, 2025, 12:19 a.m. This repo has been linked 5 different CVEs too.
Profile Photo
126789t/poc_everyday

自动搜集每天的漏洞poc和exp信息。

Updated: 5 months, 3 weeks ago
8 stars 2 fork 2 watcher
Born at : Dec. 11, 2024, 12:32 a.m. This repo has been linked 91 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-46604 vulnerability anywhere in the article.

  • CybersecurityNews
H2Miner Attacking Linux, Windows, and Containers to Mine Monero

The H2Miner botnet, first observed in late 2019, has resurfaced with an expanded arsenal that blurs the line between cryptojacking and ransomware. The latest campaign leverages inexpensive virtual pri ... Read more

Published Date: Jul 17, 2025 (2 weeks, 3 days ago)
CVE-2023-46604
  • The Register
Oracle emits 603 patches, names one it wants you to worry about soon

Oracle has delivered its regular quarterly collection of patches: 603 in total, 318 for its own products, and another 285 for Linux code it ships. Big Red’s VP of security assurance Eric Maurice singl ... Read more

Published Date: Jan 23, 2025 (6 months, 1 week ago)
CVE-2025-21556 CVE-2024-56337 CVE-2024-21287 CVE-2024-45492 CVE-2023-46604
  • The Hacker News
Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products

Vulnerability / Enterprise Security Oracle is urging customers to apply its January 2025 Critical Patch Update (CPU) to address 318 new security vulnerabilities spanning its products and services. The ... Read more

Published Date: Jan 22, 2025 (6 months, 1 week ago)
CVE-2025-21556 CVE-2025-21535 CVE-2025-21524 CVE-2024-56337 CVE-2024-21287 CVE-2024-45492 CVE-2024-37371 CVE-2024-23807 CVE-2023-3961 CVE-2023-46604 ...+3 more CVE
  • Cybersecurity News
CVE-2024-45337: Golang Crypto Library Flawed, Risks Authorization Bypass

A critical security vulnerability, tracked as CVE-2024-45337 (CVSS 9.1), has been discovered in the Golang cryptography library. This flaw stems from the misuse of the ServerConfig.PublicKeyCallback f ... Read more

Published Date: Dec 16, 2024 (7 months, 2 weeks ago)
CVE-2024-45337 CVE-2024-10781 CVE-2024-10542 CVE-2024-10524 CVE-2023-40238 CVE-2023-46604
  • Cybersecurity News
CVE-2024-55884 (CVSS 9.0): Critical Vulnerability Found in Mullvad VPN

X41 D-Sec GmbH, a leading cybersecurity firm, has completed a white-box penetration test of the Mullvad VPN application, revealing several vulnerabilities, including one rated as “critical” and two ra ... Read more

Published Date: Dec 16, 2024 (7 months, 2 weeks ago)
CVE-2024-55884 CVE-2024-10781 CVE-2024-10542 CVE-2024-10524 CVE-2023-40238 CVE-2023-46604 CVE-2017-3099
  • Cybersecurity News
Citrix Alerts on Global Password Spraying Campaigns Targeting NetScaler Appliances

Citrix has issued an advisory highlighting an increase in password spraying attacks aimed at NetScaler appliances worldwide. These attacks exploit authentication endpoints, causing significant operati ... Read more

Published Date: Dec 15, 2024 (7 months, 2 weeks ago)
CVE-2024-10781 CVE-2024-10542 CVE-2024-10524 CVE-2024-6387 CVE-2023-40238 CVE-2023-46604
  • Cybersecurity News
Earth Minotaur: MOONSHINE Exploit Kit and DarkNimbus Backdoor Threaten Multi-Platform Security

A sophisticated cyber campaign orchestrated by the threat actor Earth Minotaur has been uncovered by Trend Micro researchers, exposing their reliance on the MOONSHINE exploit kit and a previously unre ... Read more

Published Date: Dec 07, 2024 (7 months, 3 weeks ago)
CVE-2024-10781 CVE-2024-10542 CVE-2024-10524 CVE-2024-21887 CVE-2023-40238 CVE-2023-46604
  • Cybersecurity News
Five Flaws in Lorex 2K Security Cameras Enable Hackers to Take Full Control, PoC Published

Rapid7’s latest research reveals a series of critical vulnerabilities in the Lorex 2K Indoor Wi-Fi Security Camera, raising significant concerns for consumer security. The vulnerabilities, identified ... Read more

Published Date: Dec 05, 2024 (7 months, 4 weeks ago)
CVE-2024-52548 CVE-2024-52547 CVE-2024-52546 CVE-2024-52545 CVE-2024-52544 CVE-2024-10781 CVE-2024-10542 CVE-2024-10524 CVE-2024-38094 CVE-2023-40238 ...+2 more CVE
  • Cybersecurity News
Exploit Code Available: Critical Flaw Found in WhatsUp Gold- CVE-2024-8785 (CVSS 9.8)

Tenable’s latest vulnerability analysis has exposed a critical flaw, CVE-2024-8785, in WhatsUp Gold versions prior to 24.0.1. Rated with a CVSS score of 9.8, this vulnerability allows unauthenticated ... Read more

Published Date: Dec 05, 2024 (7 months, 4 weeks ago)
CVE-2024-8785 CVE-2024-10781 CVE-2024-10542 CVE-2024-10524 CVE-2024-7763 CVE-2024-6670 CVE-2023-40238 CVE-2023-46604
  • Cybersecurity News
Akira v2 Emerges: Rust-Based Ransomware Raises the Stakes

The Akira ransomware took a significant leap earlier this year with the introduction of a new Rust-based variant, according to a detailed analysis from Check Point Research (CPR). This version, known ... Read more

Published Date: Dec 05, 2024 (7 months, 4 weeks ago)
CVE-2024-10781 CVE-2024-10542 CVE-2024-10524 CVE-2024-40766 CVE-2023-40238 CVE-2023-46604
  • Cybersecurity News
Phishing Frenzy: Cloudflare Domains Exploited in Latest Attacks

A new report from cybersecurity firm Fortra has revealed a dramatic increase in the abuse of Cloudflare’s pages.dev and workers.dev domains for phishing attacks. This abuse capitalizes on Cloudflare’s ... Read more

Published Date: Dec 05, 2024 (7 months, 4 weeks ago)
CVE-2024-10781 CVE-2024-10542 CVE-2024-10524 CVE-2024-0204 CVE-2023-40238 CVE-2023-46604
  • The Hacker News
RansomHub Ransomware Group Targets 210 Victims Across Critical Sectors

Threat actors linked to the RansomHub ransomware group encrypted and exfiltrated data from at least 210 victims since its inception in February 2024, the U.S. government said. The victims span various ... Read more

Published Date: Sep 02, 2024 (11 months ago)
CVE-2024-7965 CVE-2023-48788 CVE-2023-46604 CVE-2023-46747 CVE-2023-22515 CVE-2023-3519 CVE-2023-27997
  • huntress.com
Confluence to Cerber: Exploitation of ​​CVE-2023-22518 | Huntress

On October 31, 2023, Atlassian published patches and an advisory for CVE-2023-22518, an improper authorization vulnerability affecting Confluence Data Center and Confluence Server. Later, on November ... Read more

Published Date: Jul 08, 2024 (1 year ago)
CVE-2023-22518 CVE-2023-46604
  • Google Cloud
Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools

Written by: Bavi Sadayappan, Zach Riddle, Jordan Nuce, Joshua Shilko, Jeremy Kennelly A version of this blog post was published to the Mandiant Advantage portal on April 18, 2024. Executive Summary In ... Read more

Published Date: Jun 03, 2024 (1 year, 2 months ago)
CVE-2023-22518 CVE-2023-46604 CVE-2023-4966 CVE-2023-40044 CVE-2023-20269 CVE-2023-3519 CVE-2023-3539 CVE-2023-28252 CVE-2023-24880 CVE-2022-47966 ...+11 more CVE
  • huntress.com
Confluence to Cerber: Exploitation of ​​CVE-2023-22518

On October 31, 2023, Atlassian published patches and an advisory for CVE-2023-22518, an improper authorization vulnerability affecting Confluence Data Center and Confluence Server. Later, on November ... Read more

Published Date: Nov 07, 2023 (1 year, 8 months ago)
CVE-2023-22518 CVE-2023-46604
  • huntress.com
Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604 | Huntress

A partner recently deployed Huntress agents on October 30, 2023, after experiencing a “HelloKitty” ransomware attack on October 27. This ransomware attack followed closely with what was described by R ... Read more

Published Date: Nov 02, 2023 (1 year, 9 months ago)
CVE-2023-46604
  • huntress.com
Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604 | Huntress

A partner recently deployed Huntress agents on October 30, 2023, after experiencing a “HelloKitty” ransomware attack on October 27. This ransomware attack followed closely with what was described by R ... Read more

Published Date: Nov 02, 2023 (1 year, 9 months ago)
CVE-2023-46604

The following table lists the changes that have been made to the CVE-2023-46604 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Mar. 07, 2025

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Feb. 13, 2025

    Action Type Old Value New Value
    Changed Description The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue. The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
  • Modified Analysis by [email protected]

    Jan. 23, 2025

    Action Type Old Value New Value
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2024/Apr/18
    Added Reference https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
    Added Reference https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
    Added Reference https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
    Added Reference https://security.netapp.com/advisory/ntap-20231110-0010/
    Added Reference https://www.openwall.com/lists/oss-security/2023/10/27/5
  • Modified Analysis by [email protected]

    Jun. 27, 2024

    Action Type Old Value New Value
    Changed Reference Type http://seclists.org/fulldisclosure/2024/Apr/18 No Types Assigned http://seclists.org/fulldisclosure/2024/Apr/18 Mailing List, Third Party Advisory
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List, Third Party Advisory
    Changed Reference Type https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html No Types Assigned https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
    Changed Reference Type https://security.netapp.com/advisory/ntap-20231110-0010/ No Types Assigned https://security.netapp.com/advisory/ntap-20231110-0010/ Third Party Advisory
    Changed Reference Type https://www.openwall.com/lists/oss-security/2023/10/27/5 No Types Assigned https://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:*
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Apr. 11, 2024

    Action Type Old Value New Value
    Added Reference Apache Software Foundation http://seclists.org/fulldisclosure/2024/Apr/18 [No types assigned]
  • CVE Modified by [email protected]

    Nov. 28, 2023

    Action Type Old Value New Value
    Added Reference Apache Software Foundation https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html [No types assigned]
    Removed Reference Apache Software Foundation http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
  • CVE Modified by [email protected]

    Nov. 20, 2023

    Action Type Old Value New Value
    Added Reference Apache Software Foundation https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html [No types assigned]
  • CVE Modified by [email protected]

    Nov. 14, 2023

    Action Type Old Value New Value
    Added Reference Apache Software Foundation http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html [No types assigned]
  • CVE Modified by [email protected]

    Nov. 11, 2023

    Action Type Old Value New Value
    Changed Description Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.  Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue. The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
    Added Reference Apache Software Foundation https://www.openwall.com/lists/oss-security/2023/10/27/5 [No types assigned]
    Removed Reference Apache Software Foundation http://www.openwall.com/lists/oss-security/2023/10/27/5
  • CVE Modified by [email protected]

    Nov. 10, 2023

    Action Type Old Value New Value
    Added Reference Apache Software Foundation https://security.netapp.com/advisory/ntap-20231110-0010/ [No types assigned]
  • Initial Analysis by [email protected]

    Nov. 08, 2023

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/27/5 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List, Third Party Advisory
    Changed Reference Type https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt No Types Assigned https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Vendor Advisory
    Added CPE Configuration OR *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions up to (excluding) 5.15.16 *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 5.16.0 up to (excluding) 5.16.7 *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 5.17.0 up to (excluding) 5.17.6 *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 5.18.0 up to (excluding) 5.18.3
    Added CPE Configuration OR *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions up to (excluding) 5.15.16 *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions from (including) 5.16.0 up to (excluding) 5.16.7 *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions from (including) 5.17.0 up to (excluding) 5.17.6 *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions from (including) 5.18.0 up to (excluding) 5.18.3
  • CVE Modified by [email protected]

    Oct. 27, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/27/5 [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-46604 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-46604 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

94.44 }} 0.14%

score

0.99983

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: