When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
History
07 Nov 2023, 03:03
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2019-12-23 18:15
Updated : 2024-02-28 17:28
NVD link : CVE-2019-12418
Mitre link : CVE-2019-12418
CVE.ORG link : CVE-2019-12418
JSON object : View
Products Affected
opensuse
- leap
netapp
- oncommand_system_manager
debian
- debian_linux
oracle
- workload_manager
apache
- tomcat
canonical
- ubuntu_linux
CWE