CVEvulnerability

CVE-2020-13920

5.9 MEDIUM Published 2020-09-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-09-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-306

Description

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.

Affected configurations

• apache activemq (< 5.15.12) • oracle communications diameter signaling router (>= 8.0.0 <= 8.2.2) • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • debian debian linux 9.0

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References