CVE-2023-50780 is a high severity authorization flaw in Apache ActiveMQ Artemis, scored 8.8. Before version 2.29.0 the Log4J2 MBean was reachable through the authenticated Jolokia endpoint. That could let a user write files and reach code execution. Upgrade to Artemis 2.29.0 or later.
What's affected
The Apache announcement says versions before 2.29.0 are affected and that users should upgrade to 2.29.0 or later. The record was published on 2024-10-14, even though the CVE number is from 2023.
NVD scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The sources do not give a separate vendor severity, so only the NVD score applies.
Artemis exposes diagnostic information and controls through MBeans, and those are also available through the authenticated Jolokia endpoint. Before 2.29.0 this included the Log4J2 MBean, which is not meant for non administrative users. The advisory says this could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve remote code execution. The weakness is typed CWE-285, improper authorization.
How to check if you're exposed
Check the broker version. From the install directory:
./bin/artemis version
Anything below 2.29.0 matches. Then check whether the Jolokia endpoint is reachable. The web console and its Jolokia API commonly listen on a management port. Test from a client network whether that port answers, and note which accounts can log in to it.
An exposed console with weak or shared credentials is the highest risk. Even internal consoles deserve a look, because any authenticated, non administrative user is the audience for this flaw.
What to do now
- Upgrade Artemis brokers to 2.29.0 or later.
- Restrict the management console and Jolokia endpoint to administrative networks.
- Review which users have console access and remove accounts that do not need it.
- Rotate credentials for accounts that were shared or used by applications.
- Check the broker host for unexpected files if the console was reachable by many users.
Why it matters
The weakness is improper authorization, CWE-285. The diagnostic interface was meant for administrators, but an MBean that can change logging configuration was exposed to any authenticated user. Changing logging settings can be turned into file writes, since log output goes to files the attacker can influence.
This pattern appears often in management consoles: a feature meant for operators is protected only by being logged in. A low privilege account becomes a path to full control of the host.
The record shows no CISA Known Exploited Vulnerabilities listing, and the announcement does not report exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be an administrator to use this?
No. The flaw is that a non administrative authenticated user could reach an MBean meant for administrators.
What is the fix?
Artemis 2.29.0 or later.
Sources
Last reviewed: 19 October 2026.
