Tools

Web Help Desk 12.8.1.824 (Hot Fix 1)

This article provides an overview of Web Help Desk 12.8.1.824 (Hot Fix 1), released February 1, 2024. WHD 12.8.1.824 (Hot Fix 1) addresses the CVE-2023-46604 vulnerability, in which the Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. Upgrade to the latest version of WHD to resolve this vulnerability.

First published date

2/1/2024 7:59 PM

Last published date

2/4/2025 12:02 AM

Overview

These release notes apply to Web Help Desk 12.8.1.824 (Hot Fix 1).

Fixed issues

This hotfix addresses the following issue in Web Help Desk version 12.8.1:

Apache ActiveMQ Vulnerability (CVE-2023-46604)

https://www.solarwinds.com/trust-center/security-advisories/cve-2023-46604

References:
https://activemq.apache.org/security-advisories.data/CVE-2023-46604 ActiveMQ cve-website
[AMQ-9370] Openwire marshaller should validate Throwable class type - ASF JIRA

Product section

Web Help Desk

Cause

Apache ActiveMQ Vulnerability (CVE-2023-46604)

https://www.solarwinds.com/trust-center/security-advisories/cve-2023-46604

Resolution

This hotfix requires Web Help Desk 12.8.1.758

SolarWinds would like to thank our Security Researchers below for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability.

Third Party CVEs

CVE-ID	Vulnerability Title	Description	Severity
CVE-2023-46604	Remote Code Execution Vulnerability	The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.	9.8 Critical

*Please review the SolarWinds Trust Center Document CVE-2023-46604 here: https://www.solarwinds.com/trust-center/security-advisories/cve-2023-46604

This hotfix requires Web Help Desk 12.8.1.758.

Instructions for Installing 12.8.1.824 (Hot Fix 1), released February 1, 2024

To install this hotfix, use the SolarWinds Installer as you do for other releases.

See this topic to determine your upgrade path.
Select 12.8.1.824 (Hot Fix 1) from the Available list of latest downloads for your products in the Customer Portal.
Follow these instructions to update to the latest version of WHD.

For assistance, contact SolarWinds Technical Support at:

https://www.solarwinds.com/company/contact-us

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.