Remote Code Execution in Apache TomEE with Embedded ActiveMQ Broker
CVE-2020-11969
9.8CRITICAL
What is CVE-2020-11969?
When Apache TomEE is configured to utilize the embedded ActiveMQ broker with the useJMX=true parameter, it inadvertently exposes a JMX port (TCP port 1099) without requiring authentication. This configuration flaw leaves instances of Apache TomEE vulnerable to unauthorized access, potentially allowing malicious actors to execute arbitrary commands on the server. Administrators are advised to review and adjust their configurations to prevent this exposure and enhance overall system security.
Affected Version(s)
Apache TomEE Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5