GitHub Advisoryadvisory · Maven

GHSA-7v85-6hv2-rwgw Missing certificate validation in Apache JMeter

CRITICAL Published 2022-05-13 Modified 2022-11-04 Official page ↗
Aliases
CVE-2018-1297
Ecosystem
Maven
Packages
org.apache.jmeter:ApacheJMeter
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-319
Reviewed
2022-11-04

Affected packages

• Maven org.apache.jmeter:ApacheJMeter: < 4.0 → fixed in 4.0

Description

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.

Related

Alias · CVE (1)

  • CVE-2018-1297 When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References