{"api_version":"1","generated_at":"2026-07-23T08:39:20+00:00","cve":"CVE-2014-8120","urls":{"html":"https://cve.report/CVE-2014-8120","api":"https://cve.report/api/cve/CVE-2014-8120.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-8120","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-8120"},"summary":{"title":"CVE-2014-8120","description":"The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors.","state":"PUBLISHED","assigner":"redhat","published_at":"2014-12-18 15:59:02","updated_at":"2026-05-06 22:30:45"},"problem_types":["NVD-CWE-noinfo","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.4","severity":"","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:P/A:P","baseScore":4.4,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-2000.html","name":"http://rhn.redhat.com/errata/RHSA-2014-2000.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://icedtea.classpath.org/pipermail/thermostat-announce/2014-December/000013.html","name":"http://icedtea.classpath.org/pipermail/thermostat-announce/2014-December/000013.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"[Thermostat-announce] [SECURITY UPDATE] Thermostat 1.0.6 update\treleased!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2014:2000","name":"MISC:https://access.redhat.com/errata/RHSA-2014:2000","refsource":"MITRE","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/security/cve/CVE-2014-8120","name":"MISC:https://access.redhat.com/security/cve/CVE-2014-8120","refsource":"MITRE","tags":[],"title":"CVE-2014-8120 - Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168977","name":"MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1168977","refsource":"MITRE","tags":[],"title":"1168977 – (CVE-2014-8120) CVE-2014-8120 thermostat: local JMX URL disclosure","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8120","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8120","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"8120","vulnerable":"1","versionEndIncluding":"1.0.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"thermostat_project","cpe5":"thermostat","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:10:50.645Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"[Thermostat-announce] 20141216 [SECURITY UPDATE] Thermostat 1.0.6 update released!","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://icedtea.classpath.org/pipermail/thermostat-announce/2014-December/000013.html"},{"name":"RHSA-2014:2000","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-2000.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-12-16T00:00:00.000Z","descriptions":[{"lang":"en","value":"The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-12-18T13:57:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"[Thermostat-announce] 20141216 [SECURITY UPDATE] Thermostat 1.0.6 update released!","tags":["mailing-list","x_refsource_MLIST"],"url":"http://icedtea.classpath.org/pipermail/thermostat-announce/2014-December/000013.html"},{"name":"RHSA-2014:2000","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-2000.html"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2014-8120","datePublished":"2014-12-18T15:00:00.000Z","dateReserved":"2014-10-10T00:00:00.000Z","dateUpdated":"2024-08-06T13:10:50.645Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-12-18 15:59:02","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["NVD-CWE-noinfo","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:P/A:P","baseScore":4.4,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:thermostat_project:thermostat:*:*:*:*:*:*:*:*","versionEndIncluding":"1.0.4","matchCriteriaId":"227EEABF-AABD-4DD8-BF3C-BAE154EC806B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"8120","Ordinal":"1","Title":"CVE-2014-8120","CVE":"CVE-2014-8120","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"8120","Ordinal":"1","NoteData":"The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors.","Type":"Description","Title":"CVE-2014-8120"},{"CveYear":"2014","CveId":"8120","Ordinal":"2","NoteData":"2014-12-18","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"8120","Ordinal":"3","NoteData":"2014-12-18","Type":"Other","Title":"Modified"}]}}}