CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
Authenticated attackers can achieve remote code execution by accessing exposed Log4J2 MBeans via the Jolokia endpoint in Apache ActiveMQ Artemis.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-50780?
CVE-2023-50780 is a high-severity missing authorization vulnerability in Apache ActiveMQ Artemis, published on 14 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE.
Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
Weakness: CWE-285
Which versions are affected by CVE-2023-50780?
2 open source packages ship an affected version, including org.apache.activemq:artemis-cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.activemq:artemis-cli Maven | All versions | 2.29.0 |
org.apache.activemq:artemis-cli Maven | All versions | 2.29.0 |
Products include Apache Artemis.
How do I fix CVE-2023-50780?
Upgrade org.apache.activemq:artemis-cli to 2.29.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-50780 being exploited?
There is no known exploitation of CVE-2023-50780 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache ActiveMQ Artemis
- CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
- CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
- CVE-2026-49364 Information disclosure in Apache ActiveMQ Artemis
- CVE-2026-67593 Missing authorization in Apache ActiveMQ Artemis
- CVE-2026-49362 Missing authorization in Apache ActiveMQ Artemis
Sources
Also known as GHSA-443j-grxv-2pgv.