Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
History

Fri, 22 Nov 2024 12:00:00 +0000

Type Values Removed Values Added
References

Wed, 16 Oct 2024 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache activemq Artemis
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:apache:activemq_artemis:*:*:*:*:*:*:*:*
Vendors & Products Apache
Apache activemq Artemis
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}


Wed, 16 Oct 2024 01:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

threat_severity

Important


Tue, 15 Oct 2024 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Mon, 14 Oct 2024 16:15:00 +0000

Type Values Removed Values Added
Description Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
Title Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
Weaknesses CWE-285
References

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-10-14T16:03:38.321Z

Updated: 2024-10-15T15:43:18.171Z

Reserved: 2023-12-13T13:13:06.747Z

Link: CVE-2023-50780

cve-icon Vulnrichment

Updated: 2024-10-15T15:43:12.591Z

cve-icon NVD

Status : Modified

Published: 2024-10-14T16:15:03.477

Modified: 2024-11-21T08:37:18.023

Link: CVE-2023-50780

cve-icon Redhat

Severity : Important

Publid Date: 2024-10-14T16:03:38Z

Links: CVE-2023-50780 - Bugzilla