CVE-2020-11998: Code Injection
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code. Mitigation - Upgrade to Apache ActiveMQ 5.15.13
Other sources
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-11998?
CVE-2020-11998 is a vulnerability that allows an attacker to bypass authentication in Apache ActiveMQ and Oracle Communications products.
How severe is CVE-2020-11998?
CVE-2020-11998 has a severity rating of 9.8, which is considered critical.
Which software products are affected by CVE-2020-11998?
CVE-2020-11998 affects Apache ActiveMQ version 5.15.12 and Oracle Communications products including Diameter Signaling Router, Element Manager, Session Report Manager, Session Route Manager, Enterprise Repository, and FLEXCUBE Private Banking.
How can an attacker exploit CVE-2020-11998?
An attacker can exploit CVE-2020-11998 by passing an empty environment map to RMIConnectorServer in order to bypass authentication.
Are there any references for CVE-2020-11998?
Yes, you can find references for CVE-2020-11998 at the following links: [Reference 1](http://activemq.apache.org/security-advisories.data/CVE-2020-11998-announcement.txt), [Reference 2](https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3E), [Reference 3](https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3E)