CVE-2020-11998
published 2020-09-10CVE-2020-11998: A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that…
PriorityP275critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
51.23%
98.8th percentile
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | — | — |
| debian | activemq | — | — |
| oracle | communications_diameter_signaling_router | 8.0.0 – 8.5.0 | — |
| oracle | communications_element_manager | 8.2.0 – 8.2.4.0 | — |
| oracle | communications_session_report_manager | 8.0.0 – 8.2.2 | — |
| oracle | communications_session_route_manager | 8.0.0 – 8.2.2 | — |
| oracle | enterprise_repository | — | — |
| oracle | flexcube_private_banking | — | — |
| oracle | flexcube_private_banking | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect attempts to create javax.management.loading.MLet MBeans via JMX, which can be used to load arbitrary code from remote URLs against an unauthenticated ActiveMQ JMX/RMI interface ↗
- →Monitor for unauthenticated RMI/JMX connections to ActiveMQ — the vulnerability arises because RMIConnectorServer is started with an empty environment map (no credentials), leaving the JMX port open without authentication ↗
- →Alert on remote code execution attempts via JMX MLet MBean instantiation from arbitrary URLs on Apache ActiveMQ versions prior to 5.15.13 ↗
- ·The vulnerability only exists when no Java security manager is in place; environments with a properly configured security manager are less exposed ↗
- ·This is a regression bug — the empty environment map was introduced in a specific commit intended to prevent JMX re-bind; patching to Apache ActiveMQ 5.15.13 restores proper credential passing ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_oracle9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Risk Matrix: Work orders (Apache ActiveMQ) — CVE-2020-11998
vendor_oracle·2021-10-15·CVSS 9.8
CVE-2020-11998 [CRITICAL] Oracle Oracle Communications Risk Matrix: Work orders (Apache ActiveMQ) — CVE-2020-11998
Oracle Oracle Communications Risk Matrix: Work orders (Apache ActiveMQ) vulnerability
CVE: CVE-2020-11998
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2021 (OCT 2021)
Oracle
Oracle Oracle Communications Risk Matrix: Provisioning (Apache ActiveMQ) — CVE-2020-11998
vendor_oracle·2021-07-15·CVSS 9.8
CVE-2020-11998 [CRITICAL] Oracle Oracle Communications Risk Matrix: Provisioning (Apache ActiveMQ) — CVE-2020-11998
Oracle Oracle Communications Risk Matrix: Provisioning (Apache ActiveMQ) vulnerability
CVE: CVE-2020-11998
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Financial Planning (Apache ActiveMQ) — CVE-2020-11998
vendor_oracle·2021-04-15·CVSS 9.8
CVE-2020-11998 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: Financial Planning (Apache ActiveMQ) — CVE-2020-11998
Oracle Oracle Financial Services Applications Risk Matrix: Financial Planning (Apache ActiveMQ) vulnerability
CVE: CVE-2020-11998
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Security Subsystem (Apache ActiveMQ) — CVE-2020-11998
vendor_oracle·2021-01-15·CVSS 9.8
CVE-2020-11998 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: Security Subsystem (Apache ActiveMQ) — CVE-2020-11998
Oracle Oracle Fusion Middleware Risk Matrix: Security Subsystem (Apache ActiveMQ) vulnerability
CVE: CVE-2020-11998
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
Debian
CVE-2020-11998: activemq - A regression has been introduced in the commit preventing JMX re-bind. By passin...
vendor_debian·2020·CVSS 9.8
CVE-2020-11998 [CRITICAL] CVE-2020-11998: activemq - A regression has been introduced in the commit preventing JMX re-bind. By passin...
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
Scope: local
bookworm: resolved
bullseye: resolved
sid: resolved
trixie: resolved
GHSA
Remote code execution in Apache ActiveMQ
ghsa·2022-02-09
CVE-2020-11998 [CRITICAL] CWE-94 Remote code execution in Apache ActiveMQ
Remote code execution in Apache ActiveMQ
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code. Mitigation - Upgrade to Apache ActiveMQ 5.15.13
OSV
Remote code execution in Apache ActiveMQ
osv·2022-02-09
CVE-2020-11998 [CRITICAL] Remote code execution in Apache ActiveMQ
Remote code execution in Apache ActiveMQ
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code. Mitigation - Upgrade to Apache ActiveMQ 5.15.13
OSV
CVE-2020-11998: A regression has been introduced in the commit preventing JMX re-bind
osv·2020-09-10·CVSS 9.8
CVE-2020-11998 [CRITICAL] CVE-2020-11998: A regression has been introduced in the commit preventing JMX re-bind
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
No detection rules found.
No public exploits indexed.
http://activemq.apache.org/security-advisories.data/CVE-2020-11998-announcement.txthttps://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3Ehttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://activemq.apache.org/security-advisories.data/CVE-2020-11998-announcement.txthttps://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3Ehttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2020-09-10
Published