CVE-2020-13920: Medium severity IBM Security Directory Suite VA vulnerability
Apache ActiveMQ is vulnerable to a man-in-the-middle attack, caused by improper authentication validation when connecting to the JMX RMI registry. By creating another server to proxy the original, an attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain user credentials or further compromise the system.
Other sources
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-13920?
CVE-2020-13920 is a vulnerability in Apache ActiveMQ that allows an attacker to connect to the JMX RMI registry without authentication and rebind the jmxrmi entry to something else.
What is the severity of CVE-2020-13920?
The severity of CVE-2020-13920 is medium, with a severity value of 5.9.
How does CVE-2020-13920 affect Apache ActiveMQ?
CVE-2020-13920 affects Apache ActiveMQ versions up to and excluding 5.15.12.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-13920?
The CWE ID for CVE-2020-13920 is CWE-287.
How can I fix CVE-2020-13920 in Apache ActiveMQ?
To fix CVE-2020-13920 in Apache ActiveMQ, upgrade to version 5.15.12 or later.