Vulnetix
Try Vulnetix Request Demo
CVE-2020-1954 PUBLISHED CVSS 8.699999809265137 HIGH

Reported by apache · Published April 1, 2020

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.

Risk Scores

CVSS v4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
ApacheApache CXFaffects all versions prior to 3.3.6 and 3.2.13
Mavenorg.apache.cxf:cxf-rt-management0, 0, 0
Mavenorg.apache.cxf:cxf-core0, 0, 0
ApacheApache CXFaffects all versions prior to 3.3.6 and 3.2.13, affects all versions prior to 3.3.6 and 3.2.13, affects all versions prior to 3.3.6 and 3.2.13
Mavenorg.apache.cxf:cxf0, 0, 0

Timeline

References

Open in Interactive Console →