CVE-2023-50780: Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
First published: Mon Oct 14 2024(Updated: )
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.activemq:artemis-cli | <2.29.0 | 2.29.0 |
| Apache ActiveMQ Artemis | <2.29.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-50780
- https://lists.apache.org/thread/63b78shqz312phsx7v1ryr7jv7bprg58
- https://github.com/apache/activemq-artemis/commit/cfb585eaf61d570eecd65c6ad0e92282df7d3869
- https://issues.apache.org/jira/browse/ARTEMIS-4150
- https://github.com/advisories/GHSA-443j-grxv-2pgv (Advisory)
- http://www.openwall.com/lists/oss-security/2024/10/14/2
Frequently Asked Questions
What is the severity of CVE-2023-50780?
CVE-2023-50780 has been classified as a medium severity vulnerability due to the exposure of sensitive diagnostic information.
How do I fix CVE-2023-50780?
To mitigate CVE-2023-50780, upgrade Apache ActiveMQ Artemis to version 2.29.0 or later.
What systems are affected by CVE-2023-50780?
CVE-2023-50780 affects Apache ActiveMQ Artemis versions prior to 2.29.0.
What is the main issue with CVE-2023-50780?
The main issue with CVE-2023-50780 is the exposure of the Log4J2 MBean through the Jolokia endpoint, which should not be accessible to non-administrative users.
Is user access to MBeans restricted in CVE-2023-50780?
No, in versions prior to 2.29.0, user access to MBeans was not adequately restricted, allowing unauthorized access to diagnostic controls.
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- collector/oss-sec
- source/oss-sec
- alias/CVE-2023-50780
- agent/author
- agent/softwarecombine
- agent/severity
- agent/event
- collector/github-advisory
- source/GitHub
- alias/GHSA-443j-grxv-2pgv
- agent/software-canonical-lookup
- agent/trending
- agent/source
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/references
- agent/tags
- collector/github-advisory-latest
- agent/last-modified-date
- collector/nvd-cve
- package-manager/maven
- vendor/apache
- canonical/apache activemq artemis