CVE-2019-12418 Information
Description
When Apache Tomcat 9.0.0.M1 to 9.0.28 8.5.0 to 8.5.47 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Reference
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67403Cannounce.tomcat.apache.org3E https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@3Cdev.tomcat.apache.org3E https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@3Cdev.tomcat.apache.org3E https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@3Cdev.tomcat.apache.org3E https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@3Cdev.tomcat.apache.org3E https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@3Cdev.tomcat.apache.org3E https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html https://seclists.org/bugtraq/2019/Dec/43 https://security.gentoo.org/glsa/202003-43 https://security.netapp.com/advisory/ntap-20200107-0001/ https://support.f5.com/csp/article/K10107360?utm_source=f5support&utm_medium=RSS https://usn.ubuntu.com/4251-1/ https://www.debian.org/security/2019/dsa-4596 https://www.debian.org/security/2020/dsa-4680 https://www.oracle.com/security-alerts/cpuapr2020.html
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction Required
LOW
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
HIGH
Base Severity
7.0
Share on: