CVE-2019-0187

Опубликовано: 06 мар. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.

Ссылки

http://mail-archives.apache.org/mod_mbox/jmeter-user/201903.mbox/%3CCAH9fUpaUQaFbgY1Zh4OvKSL4wdvGAmVt%2Bn4fegibDoAxK5XARw%40mail.gmail.com%3E
Mailing List
Vendor Advisory
http://www.securityfocus.com/bid/107219
Third Party Advisory
VDB Entry
http://mail-archives.apache.org/mod_mbox/jmeter-user/201903.mbox/%3CCAH9fUpaUQaFbgY1Zh4OvKSL4wdvGAmVt%2Bn4fegibDoAxK5XARw%40mail.gmail.com%3E
Mailing List
Vendor Advisory
http://www.securityfocus.com/bid/107219
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:jmeter:4.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:5.0:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00635

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-327

Связанные уязвимости

CVE-2019-0187

CVSS3: 9.8

ubuntu

почти 7 лет назад

CVE-2019-0187

CVSS3: 9.8

debian

почти 7 лет назад

Unauthenticated RCE is possible when JMeter is used in distributed mod ...

GHSA-wg37-7mrv-cfwm

CVSS3: 9.8

github

почти 7 лет назад

Unauthenticated Remote Code Execution in Apache JMeter

EPSS

Процентиль: 70%

0.00635

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-327