CVE-2023-50780

HIGH

8.8

Descricao

Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado10/14/2024

Ultima modificacao3/19/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

apache:activemq_artemis

Fraquezas (CWE)

CWE-285

Referencias

https://lists.apache.org/thread/63b78shqz312phsx7v1ryr7jv7bprg58(security@apache.org)

http://www.openwall.com/lists/oss-security/2024/10/14/2(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.