Vulnerability Description
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Activemq Artemis | < 2.29.0 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/63b78shqz312phsx7v1ryr7jv7bprg58Issue TrackingMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2024/10/14/2
FAQ
What is CVE-2023-50780?
CVE-2023-50780 is a vulnerability with a CVSS score of 8.8 (HIGH). Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also include...
How severe is CVE-2023-50780?
CVE-2023-50780 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-50780?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Activemq Artemis.