TI-2023-27710 Aliases CVE-2023-50780 GHSA-443j-grxv-2pgv

Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans

MEDIUM 55CWE-285Published 2024-10-14 · Updated 2025-03-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-285.

Summary

Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.17457 97th percentileScored 2026-11-07

Fix Partial Apache ActiveMQ Artemis (Apache Software Foundation): 2.29.0org.apache.activemq:artemis-cli (Maven): 2.29.0Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache ActiveMQ Artemis	before 2.29.0	2.29.0	Patch available	CNA
—	org.apache.activemq:artemis-cli (Maven)	before 2.29.0	2.29.0	Patch available	GHSA-443j-grxv-2pgv

Apache ActiveMQ Artemis VendorApache Affected before 2.29.0 Fixed in 2.29.0 Patch available CNA
org.apache.activemq:artemis-cli (Maven) Vendor— Affected before 2.29.0 Fixed in 2.29.0 Patch available GHSA-443j-grxv-2pgv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:artemis::::::::	before 2.29.0	Vulnerable	Apache

cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* Versions before 2.29.0 Vulnerable ·Apache

Remediation

Fix · CNA Apache ActiveMQ Artemis (Apache Software Foundation) Fixed in 2.29.0
Fix · GHSA-443j-grxv-2pgv org.apache.activemq:artemis-cli (Maven) Fixed in 2.29.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Fuse 7	Affected	No fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet

Not affected: 5 products

Red Hat AMQ Broker 7
Red Hat Build of Keycloak
Red Hat JBoss Enterprise Application Platform 7
Red Hat JBoss Enterprise Application Platform 8
Red Hat Single Sign-On 7

Timeline

2026-10-02 Threatist record created from CVE-2023-50780
2026-10-03 Alias added: GHSA-443j-grxv-2pgv

References

Advisory 2

Other 4

TI-2026-21857 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation CVSS 4.0CRITICAL 9.3
TI-2026-41732 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment CVSS 3.1CRITICAL 9.8
TI-2026-36537 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
TI-2026-47754 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
TI-2021-08067 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVSS 3.1HIGH 7.5
TI-2017-08964 Uncontrolled resource consumption in Red Hat HornetQ/Artemis CVSS 3.1HIGH 7.5

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences