[<prev] [next>] [day] [month] [year] [list]
Message-ID: <cd8a3a1e-d4a6-6d74-6703-c247031d0c49@apache.org>
Date: Mon, 14 Oct 2024 16:00:41 +0000
From: Justin Bertram <jbertram@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-50780: Apache ActiveMQ Artemis: Authenticated users could
perform RCE via Jolokia MBeans
Severity: moderate
Affected versions:
- Apache ActiveMQ Artemis before 2.29.0
Description:
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE.
Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
This issue is being tracked as ARTEMIS-4150
Credit:
Matei "Mal" Badanoiu (finder)
References:
https://activemq.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-50780
https://issues.apache.org/jira/browse/ARTEMIS-4150
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
