Log in Start free

Vulnerability · Published Dec 17, 2020 · Assigned by apache

CVE-2020-13931

Critical 9.8

In plain English

A critical-severity security flaw in Apache TomEE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.7%top 10.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.tomee:apache-tomee8.0.4GHSA-mp28-rq7g-qx62
Mavenorg.apache.tomee:apache-tomee7.1.4GHSA-mp28-rq7g-qx62
Mavenorg.apache.tomee:apache-tomee7.0.9GHSA-mp28-rq7g-qx62

Affected products (as reported)

VendorProductVersions
n/a Apache TomEE Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5

References