CVE-2018-1297

Опубликовано: 13 фев. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.

Ссылки

http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E
Mailing List
Vendor Advisory
https://bz.apache.org/bugzilla/show_bug.cgi?id=62039
Issue Tracking
Vendor Advisory
https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E
http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E
Mailing List
Vendor Advisory
https://bz.apache.org/bugzilla/show_bug.cgi?id=62039
Issue Tracking
Vendor Advisory
https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:jmeter:2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3.3:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3.3:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3.4:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3.4:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.3.4:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.5:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.5:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.5:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.5.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.5.1:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.5.1:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.5.1:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.6:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.6:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.7:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.7:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.7:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.8:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.8:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.9:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.9:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.9:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.10:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.10:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.11:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.11:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.12:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.12:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.13:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.13:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:2.13:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.0:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.0:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.0:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.0:rc4:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.0:rc5:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.1:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.1:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.1:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.1:rc4:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.2:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.2:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.2:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:3.3:rc1:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.23187

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-319

Связанные уязвимости

CVE-2018-1297

CVSS3: 9.8

ubuntu

почти 8 лет назад

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.

CVE-2018-1297

CVSS3: 9.8

debian

почти 8 лет назад

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3. ...

GHSA-7v85-6hv2-rwgw

CVSS3: 9.8

github

больше 3 лет назад

Missing certificate validation in Apache JMeter

EPSS

Процентиль: 96%

0.23187

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-319