GitHub Advisoryadvisory · Maven

GHSA-hh3j-x4mc-g48r Insufficiently Protected Credentials in Apache Tomcat

HIGH Published 2019-12-26 Modified 2022-04-19 Official page ↗
Aliases
CVE-2019-12418
Ecosystem
Maven
Packages
org.apache.tomcat.embed:tomcat-embed-core
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-522
Reviewed
2019-12-26

Affected packages

• Maven org.apache.tomcat.embed:tomcat-embed-core: < 7.0.99 → fixed in 7.0.99 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 8.0.0, < 8.5.49 → fixed in 8.5.49 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.0, < 9.0.29 → fixed in 9.0.29

Description

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.

Related

Alias · CVE (1)

  • CVE-2019-12418 When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References