GHSA-mp28-rq7g-qx62

Source

https://github.com/advisories/GHSA-mp28-rq7g-qx62

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-mp28-rq7g-qx62/GHSA-mp28-rq7g-qx62.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mp28-rq7g-qx62

Aliases

CVE-2020-13931

Published

2022-02-09T22:44:38Z

Modified

2023-11-08T04:02:22.832603Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Remote code execution in Apache TomEE

Details

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.

Database specific

{
    "nvd_published_at": "2020-12-18T00:15:00Z",
    "github_reviewed_at": "2021-04-08T20:55:45Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-306"
    ]
}

References

Affected packages

Maven / org.apache.tomee:apache-tomee

Package

Name: org.apache.tomee:apache-tomee; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomee/apache-tomee

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.0.0

Fixed

8.0.4

Affected versions

8.*

8.0.0

8.0.1

8.0.2

8.0.3

Maven / org.apache.tomee:apache-tomee

Package

Name: org.apache.tomee:apache-tomee; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomee/apache-tomee

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.1.0

Fixed

7.1.4

Affected versions

7.*

7.1.0

7.1.1

7.1.2

7.1.3

Maven / org.apache.tomee:apache-tomee

Package

Name: org.apache.tomee:apache-tomee; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomee/apache-tomee

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.0.9

Affected versions

7.*

7.0.0-M1

7.0.0-M2

7.0.0-M3

7.0.0

7.0.1

7.0.2

7.0.3

7.0.4

7.0.5

7.0.6

7.0.7

7.0.8