1. Home
  2. Vulnerabilities
  3. CVE-2023-46604
Known Exploited Vulnerability
10.0
CRITICAL CVSS 3.1
CVE-2023-46604
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability - [Actively Exploited]
Description

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

INFO

Published Date :

Oct. 27, 2023, 3:15 p.m.

Last Modified :

Feb. 13, 2025, 6:15 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604

Affected Products

The following products are affected by CVE-2023-46604 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Netapp e-series_santricity_unified_manager
2 Netapp e-series_santricity_web_services_proxy
3 Netapp santricity_storage_plugin
1 Apache activemq
2 Apache activemq_legacy_openwire_module
1 Debian debian_linux
: Total Affected Vendor : 3 | Products : 6
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL [email protected]
CVSS 3.1 CRITICAL [email protected]
Solution
This vulnerability allows for remote code execution; upgrading ActiveMQ and related packages is recommended.
  • Upgrade Apache ActiveMQ to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 or later.
  • Upgrade the activemq packages.
Public PoC/Exploit Available at Github

CVE-2023-46604 has a 73 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2023-46604.

URL Resource
http://seclists.org/fulldisclosure/2024/Apr/18 Mailing List Third Party Advisory
https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20231110-0010/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List
http://seclists.org/fulldisclosure/2024/Apr/18 Mailing List Third Party Advisory
https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20231110-0010/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-46604 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-46604 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
amnaamjid/IS-825-Vulnerability-Exploitation-Defence

None

Updated: 1 month, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : July 2, 2025, 6:16 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
erickrr-bd/PoC-CVE

Proof of concept (PoC) repository for specific CVEs.

Dockerfile Python Java Classic ASP

Updated: 3 weeks, 3 days ago
0 stars 1 fork 1 watcher
Born at : June 25, 2025, 5:09 p.m. This repo has been linked 3 different CVEs too.
Profile Photo
cc8700619/poc

None

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : June 10, 2025, 6:57 a.m. This repo has been linked 105 different CVEs too.
Profile Photo
Linathimqalo/cloud-honeypot-analysis

A comparative cloud honeypot project that utilises google cloud platform and microsoft azure.

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : June 1, 2025, 11:43 a.m. This repo has been linked 7 different CVEs too.
Profile Photo
hdgokani/Golangexploit

None

Go PHP JavaScript Groovy Java Python VBScript

Updated: 3 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : May 8, 2025, 10:43 a.m. This repo has been linked 5 different CVEs too.
Profile Photo
CCIEVoice2009/CVE-2023-46604

None

Python Shell

Updated: 3 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : May 4, 2025, 2:42 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
myonggyu/whs

None

Python

Updated: 4 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : April 17, 2025, 7:04 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
g1san/Agents-for-Vulnerable-Dockers-and-related-Benchmarks

This thesis project focuses on the creation of an autonomous agent that is capable of understanding CVE description and create from its interpretation a vulnerable Docker container, which can then be used to gather attack patterns data. The Docker creation process is benchmarked in order to understand how well the agent is performing its tasks.

Dockerfile HTML Python Shell Groovy PHP Java SaltStack JavaScript CSS

Updated: 6 days, 12 hours ago
0 stars 0 fork 0 watcher
Born at : April 1, 2025, 1:35 p.m. This repo has been linked 115 different CVEs too.
Profile Photo
Charlemagne-ai/aws-tpot-honeypot

None

Updated: 4 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : March 9, 2025, 7:32 p.m. This repo has been linked 4 different CVEs too.
Profile Photo
skrkcb2/CVE-2023-46604

None

Updated: 5 months, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : Feb. 27, 2025, 2:49 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
TheOffender/dock-n-pwn

A modular, dockerized pentesting environment

Shell PHP Python Dockerfile Java Groovy HTML Ruby CSS JavaScript

Updated: 5 months, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : Feb. 24, 2025, 5:19 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
hungnqdz/cve

None

Shell Dockerfile Makefile C Java HTML Python Visual Basic 6.0 VBA PLSQL

Updated: 4 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Feb. 21, 2025, 9:34 a.m. This repo has been linked 4 different CVEs too.
Profile Photo
plzheheplztrying/cve_monitor

None

HTML Python Shell

Updated: 1 month, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Feb. 13, 2025, 8:50 a.m. This repo has been linked 891 different CVEs too.
Profile Photo
skrkcb2/Secure

portfolio

Updated: 5 months, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : Jan. 16, 2025, 12:19 a.m. This repo has been linked 5 different CVEs too.
Profile Photo
126789t/poc_everyday

自动搜集每天的漏洞poc和exp信息。

Updated: 6 months, 1 week ago
8 stars 2 fork 2 watcher
Born at : Dec. 11, 2024, 12:32 a.m. This repo has been linked 91 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-46604 vulnerability anywhere in the article.

  • Daily CyberSecurity
25W Wireless Charging Arrives: Qi 2.2 Ushers in a New Era of Fast Power

The Wireless Power Consortium (WPC) has officially introduced the Qi 2.2 wireless charging standard, offering devices with full protocol support a maximum charging power of 25W—a substantial leap that ... Read more

Published Date: Aug 24, 2025 (10 hours, 44 minutes ago)
  • Daily CyberSecurity
How Attackers Exploit and Then Patch a Vulnerability to Hide in Linux Systems

Red Canary has revealed a sophisticated attack campaign targeting cloud-based Linux systems through a critical remote code execution flaw in Apache ActiveMQ (CVE-2023-46604). The campaign showcases ho ... Read more

Published Date: Aug 21, 2025 (3 days, 21 hours ago)
  • Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto
New DripDropper Malware Exploits Linux Flaw Then Patches It Lock Rivals Out

A new report from Red Canary reveals a clever Linux malware called DripDropper that exploits a flaw and then patches it to prevent other hackers from getting in. Learn how this tactic works. A new rep ... Read more

Published Date: Aug 20, 2025 (4 days, 7 hours ago)
  • CybersecurityNews
Hackers Exploiting Apache ActiveMQ Vulnerability to Gain Access to Cloud Linux Systems

A sophisticated campaign uncovered where adversaries are exploiting CVE-2023-46604, a critical remote code execution vulnerability in Apache ActiveMQ, to compromise cloud-based Linux systems. In this ... Read more

Published Date: Aug 20, 2025 (4 days, 12 hours ago)
  • CybersecurityNews
Paper Werewolf Exploiting WinRAR Zero‑Day Vulnerability to Deliver Malware

Cybersecurity researchers have uncovered a sophisticated campaign by the Paper Werewolf threat actor group, also known as GOFFEE, targeting Russian organizations through the exploitation of critical v ... Read more

Published Date: Aug 20, 2025 (4 days, 12 hours ago)
  • security.nl
Aanvallers patchen Apache ActiveMQ-lek na compromitteren van server

Aanvallers maken misbruik van een kritieke kwetsbaarheid in Apache ActiveMQ om Linux-servers te compromitteren en patchen het lek zodra ze binnen zijn. Dat stelt securitybedrijf Red Canary in een anal ... Read more

Published Date: Aug 20, 2025 (4 days, 12 hours ago)
  • The Register
Like burglars closing a door, Apache ActiveMQ attackers patch critical vuln after breaking in

Criminals exploiting a critical vulnerability in open source Apache ActiveMQ middleware are fixing the flaw that allowed them access, after establishing persistence on Linux servers. Researchers at se ... Read more

Published Date: Aug 19, 2025 (5 days ago)
  • The Hacker News
Apache ActiveMQ Flaw Exploited to Deploy DripDropper Malware on Cloud Linux Systems

Aug 19, 2025Ravie LakshmananLinux / Malware Threat actors are exploiting a nearly two-year-old security flaw in Apache ActiveMQ to gain persistent access to cloud Linux systems and deploy malware ca ... Read more

Published Date: Aug 19, 2025 (5 days, 3 hours ago)
  • Red Canary
Patching for persistence: How DripDropper Linux malware moves through the cloud

It may seem counterintuitive for an adversary to “fix” a compromised system after gaining remote access but in many scenarios the motivation can be twofold. It’s a great way to potentially lock out ot ... Read more

Published Date: Aug 19, 2025 (5 days, 8 hours ago)
  • CybersecurityNews
H2Miner Attacking Linux, Windows, and Containers to Mine Monero

The H2Miner botnet, first observed in late 2019, has resurfaced with an expanded arsenal that blurs the line between cryptojacking and ransomware. The latest campaign leverages inexpensive virtual pri ... Read more

Published Date: Jul 17, 2025 (1 month, 1 week ago)
  • The Register
Oracle emits 603 patches, names one it wants you to worry about soon

Oracle has delivered its regular quarterly collection of patches: 603 in total, 318 for its own products, and another 285 for Linux code it ships. Big Red’s VP of security assurance Eric Maurice singl ... Read more

Published Date: Jan 23, 2025 (7 months ago)
  • The Hacker News
Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products

Vulnerability / Enterprise Security Oracle is urging customers to apply its January 2025 Critical Patch Update (CPU) to address 318 new security vulnerabilities spanning its products and services. The ... Read more

Published Date: Jan 22, 2025 (7 months ago)
  • Cybersecurity News
CVE-2024-45337: Golang Crypto Library Flawed, Risks Authorization Bypass

A critical security vulnerability, tracked as CVE-2024-45337 (CVSS 9.1), has been discovered in the Golang cryptography library. This flaw stems from the misuse of the ServerConfig.PublicKeyCallback f ... Read more

Published Date: Dec 16, 2024 (8 months, 1 week ago)
  • Cybersecurity News
CVE-2024-55884 (CVSS 9.0): Critical Vulnerability Found in Mullvad VPN

X41 D-Sec GmbH, a leading cybersecurity firm, has completed a white-box penetration test of the Mullvad VPN application, revealing several vulnerabilities, including one rated as “critical” and two ra ... Read more

Published Date: Dec 16, 2024 (8 months, 1 week ago)
  • Cybersecurity News
Citrix Alerts on Global Password Spraying Campaigns Targeting NetScaler Appliances

Citrix has issued an advisory highlighting an increase in password spraying attacks aimed at NetScaler appliances worldwide. These attacks exploit authentication endpoints, causing significant operati ... Read more

Published Date: Dec 15, 2024 (8 months, 1 week ago)
  • Cybersecurity News
Earth Minotaur: MOONSHINE Exploit Kit and DarkNimbus Backdoor Threaten Multi-Platform Security

A sophisticated cyber campaign orchestrated by the threat actor Earth Minotaur has been uncovered by Trend Micro researchers, exposing their reliance on the MOONSHINE exploit kit and a previously unre ... Read more

Published Date: Dec 07, 2024 (8 months, 2 weeks ago)
  • Cybersecurity News
Five Flaws in Lorex 2K Security Cameras Enable Hackers to Take Full Control, PoC Published

Rapid7’s latest research reveals a series of critical vulnerabilities in the Lorex 2K Indoor Wi-Fi Security Camera, raising significant concerns for consumer security. The vulnerabilities, identified ... Read more

Published Date: Dec 05, 2024 (8 months, 2 weeks ago)
  • Cybersecurity News
Exploit Code Available: Critical Flaw Found in WhatsUp Gold- CVE-2024-8785 (CVSS 9.8)

Tenable’s latest vulnerability analysis has exposed a critical flaw, CVE-2024-8785, in WhatsUp Gold versions prior to 24.0.1. Rated with a CVSS score of 9.8, this vulnerability allows unauthenticated ... Read more

Published Date: Dec 05, 2024 (8 months, 2 weeks ago)
  • Cybersecurity News
Akira v2 Emerges: Rust-Based Ransomware Raises the Stakes

The Akira ransomware took a significant leap earlier this year with the introduction of a new Rust-based variant, according to a detailed analysis from Check Point Research (CPR). This version, known ... Read more

Published Date: Dec 05, 2024 (8 months, 2 weeks ago)
  • Cybersecurity News
Phishing Frenzy: Cloudflare Domains Exploited in Latest Attacks

A new report from cybersecurity firm Fortra has revealed a dramatic increase in the abuse of Cloudflare’s pages.dev and workers.dev domains for phishing attacks. This abuse capitalizes on Cloudflare’s ... Read more

Published Date: Dec 05, 2024 (8 months, 2 weeks ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2023-46604 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Mar. 07, 2025

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Feb. 13, 2025

    Action Type Old Value New Value
    Changed Description The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue. The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
  • Modified Analysis by [email protected]

    Jan. 23, 2025

    Action Type Old Value New Value
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2024/Apr/18
    Added Reference https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
    Added Reference https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
    Added Reference https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
    Added Reference https://security.netapp.com/advisory/ntap-20231110-0010/
    Added Reference https://www.openwall.com/lists/oss-security/2023/10/27/5
  • Modified Analysis by [email protected]

    Jun. 27, 2024

    Action Type Old Value New Value
    Changed Reference Type http://seclists.org/fulldisclosure/2024/Apr/18 No Types Assigned http://seclists.org/fulldisclosure/2024/Apr/18 Mailing List, Third Party Advisory
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html Mailing List, Third Party Advisory
    Changed Reference Type https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html No Types Assigned https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
    Changed Reference Type https://security.netapp.com/advisory/ntap-20231110-0010/ No Types Assigned https://security.netapp.com/advisory/ntap-20231110-0010/ Third Party Advisory
    Changed Reference Type https://www.openwall.com/lists/oss-security/2023/10/27/5 No Types Assigned https://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:*
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Apr. 11, 2024

    Action Type Old Value New Value
    Added Reference Apache Software Foundation http://seclists.org/fulldisclosure/2024/Apr/18 [No types assigned]
  • CVE Modified by [email protected]

    Nov. 28, 2023

    Action Type Old Value New Value
    Added Reference Apache Software Foundation https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html [No types assigned]
    Removed Reference Apache Software Foundation http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
  • CVE Modified by [email protected]

    Nov. 20, 2023

    Action Type Old Value New Value
    Added Reference Apache Software Foundation https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html [No types assigned]
  • CVE Modified by [email protected]

    Nov. 14, 2023

    Action Type Old Value New Value
    Added Reference Apache Software Foundation http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html [No types assigned]
  • CVE Modified by [email protected]

    Nov. 11, 2023

    Action Type Old Value New Value
    Changed Description Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.  Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue. The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
    Added Reference Apache Software Foundation https://www.openwall.com/lists/oss-security/2023/10/27/5 [No types assigned]
    Removed Reference Apache Software Foundation http://www.openwall.com/lists/oss-security/2023/10/27/5
  • CVE Modified by [email protected]

    Nov. 10, 2023

    Action Type Old Value New Value
    Added Reference Apache Software Foundation https://security.netapp.com/advisory/ntap-20231110-0010/ [No types assigned]
  • Initial Analysis by [email protected]

    Nov. 08, 2023

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/27/5 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/27/5 Mailing List, Third Party Advisory
    Changed Reference Type https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt No Types Assigned https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt Vendor Advisory
    Added CPE Configuration OR *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions up to (excluding) 5.15.16 *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 5.16.0 up to (excluding) 5.16.7 *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 5.17.0 up to (excluding) 5.17.6 *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 5.18.0 up to (excluding) 5.18.3
    Added CPE Configuration OR *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions up to (excluding) 5.15.16 *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions from (including) 5.16.0 up to (excluding) 5.16.7 *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions from (including) 5.17.0 up to (excluding) 5.17.6 *cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* versions from (including) 5.18.0 up to (excluding) 5.18.3
  • CVE Modified by [email protected]

    Oct. 27, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/27/5 [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 10
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

94.44 }} 0.14%

score

0.99983

percentile