CVE-2018-1287: Critical severity apache jmeter vulnerability
Published Feb 14, 2018
·Updated
In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
Affected Software
63 affected components
Apache JMeter=2.1
Apache JMeter=2.2
Apache JMeter=2.3
Apache JMeter=2.3.1
Apache JMeter=2.3.2
Apache JMeter=2.3.3
Apache JMeter=2.3.3-rc1
Apache JMeter=2.3.3-rc2
Apache JMeter=2.3.4
Apache JMeter=2.3.4-rc1
Apache JMeter=2.3.4-rc2
Apache JMeter=2.3.4-rc3
Apache JMeter=2.4
Apache JMeter=2.5
Apache JMeter=2.5-rc1
Apache JMeter=2.5-rc2
Apache JMeter=2.5-rc3
Apache JMeter=2.5.1
Apache JMeter=2.5.1-rc1
Apache JMeter=2.5.1-rc2
Apache JMeter=2.5.1-rc3
Apache JMeter=2.6
Apache JMeter=2.6-rc1
Apache JMeter=2.6-rc2
Apache JMeter=2.7
Apache JMeter=2.7-rc1
Apache JMeter=2.7-rc2
Apache JMeter=2.7-rc3
Apache JMeter=2.8
Apache JMeter=2.8-rc1
Apache JMeter=2.8-rc2
Apache JMeter=2.9
Apache JMeter=2.9-rc1
Apache JMeter=2.9-rc2
Apache JMeter=2.9-rc3
Apache JMeter=2.10-rc1
Apache JMeter=2.10-rc2
Apache JMeter=2.11
Apache JMeter=2.11-rc1
Apache JMeter=2.11-rc2
Apache JMeter=2.12
Apache JMeter=2.12-rc1
Apache JMeter=2.12-rc2
Apache JMeter=2.13
Apache JMeter=2.13-rc1
Apache JMeter=2.13-rc2
Apache JMeter=3.0
Apache JMeter=3.0-rc1
Apache JMeter=3.0-rc2
Apache JMeter=3.0-rc3
Apache JMeter=3.0-rc4
Apache JMeter=3.0-rc5
Apache JMeter=3.1
Apache JMeter=3.1-rc1
Apache JMeter=3.1-rc2
Apache JMeter=3.1-rc3
Apache JMeter=3.1-rc4
Apache JMeter=3.2
Apache JMeter=3.2-rc1
Apache JMeter=3.2-rc2
Apache JMeter=3.2-rc3
Apache JMeter=3.3
Apache JMeter=3.3-rc1
Event History
Feb 14, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-1287?
The severity of CVE-2018-1287 is classified as critical, with a score of 9.8.
2
How do I fix CVE-2018-1287?
To fix CVE-2018-1287, upgrade to Apache JMeter version 3.3 or later.
3
What does CVE-2018-1287 vulnerabilities impact?
CVE-2018-1287 impacts Apache JMeter versions 2.1 to 3.2 when using Distributed Test with RMI.
4
What kind of attack is possible with CVE-2018-1287?
CVE-2018-1287 could allow an attacker to access JMeterEngine and execute unauthorized code.
5
How does CVE-2018-1287 exploit the system?
CVE-2018-1287 exploits the system by binding the RMI Registry to a wildcard host.