CVE-2020-13931: Critical severity apache tomee vulnerability
If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-13931?
CVE-2020-13931 is a vulnerability in Apache TomEE versions 8.0.0-M1 to 8.0.3, 7.1.0 to 7.1.3, 7.0.0-M1 to 7.0.8, and 1.0.0 to 1.7.5 that allows unauthorized access to the JMX port if the embedded ActiveMQ broker is misconfigured.
What software is affected by CVE-2020-13931?
Apache TomEE versions 8.0.0-M1 to 8.0.3, 7.1.0 to 7.1.3, 7.0.0-M1 to 7.0.8, and 1.0.0 to 1.7.5 are affected by CVE-2020-13931.
What is the severity of CVE-2020-13931?
CVE-2020-13931 has a severity rating of 9.8 (critical).
How can I fix CVE-2020-13931?
To fix CVE-2020-13931, ensure that the embedded ActiveMQ broker is properly configured to enable authentication on the JMX port (TCP port 1099). Refer to the Apache TomEE documentation for specific configuration steps.
Where can I find more information about CVE-2020-13931?
You can find more information about CVE-2020-13931 on the Apache TomEE mailing list archives listed in the references section.