CVE-2019-2684

CWE-200 — Information ExposureCWE-668 — Exposure to Wrong Sphere13 documents10 sources
Severity
5.9MEDIUM
EPSS
1.3%
top 20.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
18
Apache CassandraHP XP7 Command ViewApache Tomcat+15 more
Timeline
PublishedApr 23
Latest updateMay 24

Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java S…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages13 packages

▶CVEListV5oracle_corporation/javaJava SE Embedded: 8u201, Java SE: 7u211, 8u202, 11.0.2, 12+1
▶NVDoracle/jdk4 versions+3
▶NVDoracle/jre4 versions+3
▶NVDapache/cassandra2.1.0 — 2.1.22+4
▶NVDhp/xp7_command_view< 8.6.5-00

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 16.04, 18.04, 18.10, 19.04, Enterprise Linux 8.0, 8.1, 8.2, 8.4, 8.6, Openshift Container Platform 3.11

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-x59f-cpgf-vmmv: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI)↗2022-05-24
▶
GHSA
Man-in-the-middle attack in Apache Cassandra↗2021-05-07
▶
OSV
openjdk-8, openjdk-lts vulnerabilities↗2019-05-13
▶
OSV
CVE-2019-2684: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI)↗2019-04-23
▶
CVEList
CVE-2019-2684: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI)↗2019-04-23
▶

📋Vendor Advisories

5
Red Hat
cassandra: allows manipulation of the RMI registry to perform a MITM attack and capture user names and passwords used to access the JMX interface↗2020-09-01
▶
Ubuntu
OpenJDK vulnerabilities↗2019-05-13
▶
Red Hat
OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)↗2019-04-16
▶
Debian
CVE-2019-2684: openjdk-11 - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subc...↗2019
▶
Apache
Apache tomcat: CVE-2019-2684↗
▶

💬Community

2
Bugzilla
CVE-2020-13946 cassandra: allows manipulation of the RMI registry to perform a MITM attack and capture user names and passwords used to access the JMX interface↗2020-09-04
▶
Bugzilla
CVE-2019-2684 OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)↗2019-04-16
▶