GitHub Advisoryadvisory · Maven

GHSA-836g-5fr5-fgcr Missing Authentication for Critical Function in Apache TomEE

HIGH Published 2022-02-10 Modified 2021-07-29 Official page ↗
Aliases
CVE-2020-11969
Ecosystem
Maven
Packages
org.apache.tomee:tomee
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306
Reviewed
2021-05-12

Affected packages

• Maven org.apache.tomee:tomee: >= 8.0.0-M1, < 8.0.2 → fixed in 8.0.2 • Maven org.apache.tomee:tomee: >= 7.1.0, < 7.1.3 → fixed in 7.1.3 • Maven org.apache.tomee:tomee: >= 7.0.0-M1, < 7.0.8 → fixed in 7.0.8 • Maven org.apache.tomee:tomee: >= 1.0.0, < 1.7.6 → fixed in 1.7.6

Description

If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.

Related

Alias · CVE (1)

  • CVE-2020-11969 If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is… vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References