High severity · published Oct 14, 2024
CVE-2023-50780
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint
8.8
CVSS
17.5%
EPSS
No
On KEV
Description
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE.
Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)17.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Artemis · Apache
before 2.29.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50780
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50780
Issue Tracking
https://lists.apache.org/thread/63b78shqz312phsx7v1ryr7jv7bprg58
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/10/14/2
More from Artemis
9.8
CVE-2026-57967
Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
9.8
CVE-2026-27446
Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
9.1
CVE-2026-49364
Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
9.1
CVE-2026-67593
Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
7.5
CVE-2026-49362
Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation