CVE-2019-12418
Summary
| CVE | CVE-2019-12418 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-12-23 18:15:00 UTC |
| Updated | 2023-11-07 03:03:00 UTC |
| Description | When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Tomcat | All | All | All | All |
| Application | Apache | Tomcat | All | All | All | All |
| Application | Apache | Tomcat | All | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Netapp | Oncommand System Manager | All | All | All | All |
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
| Application | Oracle | Workload Manager | 12.2.0.1 | All | All | All |
| Application | Oracle | Workload Manager | 18c | All | All | All |
| Application | Oracle | Workload Manager | 19c | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| January 2020 Apache Tomcat Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| Pony Mail! | MLIST | lists.apache.org | |
| Bugtraq: [SECURITY] [DSA 4596-1] tomcat8 security update | BUGTRAQ | seclists.org | Mailing List, Third Party Advisory |
| myF5 | support.f5.com | ||
| [SECURITY] [DLA 2155-1] tomcat8 security update | MLIST | lists.debian.org | |
| support.f5.com/csp/article/K10107360 | CONFIRM | support.f5.com | |
| [security-announce] openSUSE-SU-2020:0038-1: important: Security update | SUSE | lists.opensuse.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Debian -- Security Information -- DSA-4596-1 tomcat8 | DEBIAN | www.debian.org | Third Party Advisory |
| [SECURITY] [DLA 2077-1] tomcat7 security update | MLIST | lists.debian.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Apache Tomcat: Multiple vulnerabilities (GLSA 202003-43) — Gentoo security | GENTOO | security.gentoo.org | |
| Debian -- Security Information -- DSA-4680-1 tomcat9 | DEBIAN | www.debian.org | |
| USN-4251-1: Tomcat vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | |
| Pony Mail! | CONFIRM | lists.apache.org | Mailing List, Vendor Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Oracle Critical Patch Update Advisory - April 2020 | N/A | www.oracle.com | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 20283 Oracle Database 19c Critical OJVM Patch Update - April 2020
- 20291 Oracle Database 18c Critical OJVM Patch Update - April 2020
- 296077 Oracle Solaris 11.4 Support Repository Update (SRU) 18.4.0 Missing (CPUJAN2020)
- 352283 Amazon Linux Security Update for tomcat7: AL2012-2020-297
- 355093 Amazon Linux Security Advisory for tomcat : ALAS2-2023-2047
- 356243 Amazon Linux Security Advisory for tomcat : ALASTOMCAT8.5-2023-013
- 356298 Amazon Linux Security Advisory for tomcat : ALASTOMCAT9-2023-008
- 730434 Update TITLE manually (JRASERVER-70487)
- 730441 Atlassian Jira Local Privilege Escalation Vulnerability (JRASERVER-70487)
- 730449 (JRASERVER-70487)
- 730995 Apache Tomcat Local Privilege Escalation Vulnerability (Unauthenticated Check)
- 981953 Java (maven) Security Update for org.apache.tomcat.embed:tomcat-embed-core (GHSA-hh3j-x4mc-g48r)