CVE-2020-13931

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomee:7.0.0:m1:*:*:*:*:*:*
cpe:2.3:a:apache:tomee:7.0.0:m2:*:*:*:*:*:*
cpe:2.3:a:apache:tomee:7.0.0:m3:*:*:*:*:*:*
cpe:2.3:a:apache:tomee:8.0.0:m1:*:*:*:*:*:*

History

07 Nov 2023, 03:17

Type Values Removed Values Added
References
  • {'url': 'https://lists.apache.org/thread.html/r85b87478f8aa4751aa3a06e88622e80ffabae376ee7283e147ee56b9@%3Cdev.tomee.apache.org%3E', 'name': '[tomee-dev] 20201223 Re: CVE-2020-13931 is Fake vulnerability', 'tags': ['Vendor Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/r7f98907165b355dc65f28a57f15103a06173ce03261115fa46d569b4@%3Cdev.tomee.apache.org%3E', 'name': '[tomee-dev] 20201222 Re: CVE-2020-13931 is Fake vulnerability', 'tags': ['Mailing List', 'Vendor Advisory'], 'refsource': 'MLIST'}
  • () https://lists.apache.org/thread.html/r7f98907165b355dc65f28a57f15103a06173ce03261115fa46d569b4%40%3Cdev.tomee.apache.org%3E -
  • () https://lists.apache.org/thread.html/r85b87478f8aa4751aa3a06e88622e80ffabae376ee7283e147ee56b9%40%3Cdev.tomee.apache.org%3E -

Information

Published : 2020-12-18 00:15

Updated : 2024-02-28 18:08


NVD link : CVE-2020-13931

Mitre link : CVE-2020-13931

CVE.ORG link : CVE-2020-13931


JSON object : View

Products Affected

apache

  • tomee