Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2023-50780

HighPublished

Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans

Published: Oct 14, 2024
Updated: Mar 19, 2025
Assigning CNA: apache
Evidence observed: Aug 8, 2026

Primary CVSS

8.8/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

17.5%

Moderate · next 30 days

Percentile: 97.1%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.

Sources

CVE-2023-50780PoC
CVE-2023-50780: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ Artemis
Log4JolokiaExploit
Python3 implementation for exploiting Log4J over Jolokia
MAL-011Exploit
MAL-011: Log4J Misconfiguration Allows Malicious JavaScript in Red Hat AMQ

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.