CVE-2023-50780highCWE-285

CVE-2023-50780: falha de alta gravidade em Apache ActiveMQ Artemis

Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache ActiveMQ Artemis+ Monitorar org.apache.activemq:artemis-cli

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

26Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 17%
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache ActiveMQ Artemis
CVEs relacionadas — Apache ActiveMQ Artemis

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27446CRITICALApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationEPSS 11.4%CVE-2021-26118—Flaw in ActiveMQ Artemis OpenWire supportEPSS 3.9%CVE-2022-23913—Apache ActiveMQ Artemis DoSEPSS 2.7%CVE-2022-35278—HTML Injection in ActiveMQ Artemis Web ConsoleEPSS 1.8%CVE-2026-57967CRITICALApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachmentEPSS 1.5%CVE-2026-67593CRITICALApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletionEPSS 0.9%