PT-2023-9583 · Apache · Apache Activemq Artemis+1

Mal + 1 · Publicado 2023-12-13 · Atualizado 2026-06-15 · CVE-2023-50780

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions prior to 2.29.0

Description The issue is related to the exposure of diagnostic information and controls through MBeans, which are also accessible through the authenticated Jolokia endpoint. This includes the Log4J2 MBean, which is not intended for non-administrative users. An authenticated attacker could exploit this to write arbitrary files to the filesystem, potentially leading to remote code execution.

Recommendations For Apache ActiveMQ Artemis versions prior to 2.29.0, upgrade to version 2.29.0 or later to fix the issue. As a temporary workaround, consider restricting access to the Jolokia endpoint and MBeans to minimize the risk of exploitation. Avoid using the Log4J2 MBean for non-administrative purposes until the issue is resolved.

Correção

RCE

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

BDU:2024-08497

CVE-2023-50780

GHSA-443J-GRXV-2PGV

Produtos afetados

Apache Activemq Artemis

Log4J2

Referências · 19

• https://github.com/apache/activemq-artemis · Nota
• https://github.com/apache/activemq-artemis/commit/cfb585eaf61d570eecd65c6ad0e92282df7d3869 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-50780 · Nota de Segurança
• https://t.me/cvedetector/7822 · Publicação no Telegram
• https://t.me/cveNotify/167386 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-50780 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1845862017174827277 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2024-08497 · Nota de Segurança
• https://t.me/cvenotify/97996 · Publicação no Telegram
• https://vuldb.com/?id.280274 · Nota
• https://twitter.com/oss_security/status/1845925556056895918 · Publicação no Twitter
• https://lists.apache.org/thread/63b78shqz312phsx7v1ryr7jv7bprg58 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-443j-grxv-2pgv · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1845955715942268964 · Publicação no Twitter
• https://twitter.com/cracbot/status/1847518108925493464 · Publicação no Twitter