Justin Bertram

**Name of the Vulnerable Software and Affected Versions** Apache Artemis versions 2.50.0 through 2.51.0 Apache ActiveMQ Artemis versions 2.11.0 through 2.44.0 **Description** A missing authentication check for a critical function exists in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can leverage the Core protocol to force a broker to establish an outbound Core federation connection to a rogue broker controlled by the attacker. This could lead to message injection into any queue and/or message exfiltration from any queue through the rogue broker. The issue impacts environments that permit both incoming Core protocol connections from untrusted sources and outgoing Core protocol connections to untrusted targets. **Recommendations** Upgrade to Apache Artemis version 2.52.0. Remove Core protocol support from any acceptor receiving connections from untrusted sources. Use two-way SSL (certificate-based authentication) to require clients to present a valid SSL certificate before any message protocol handshake.