Man-in-the-Middle Vulnerability in Apache CXF JMX Integration

CVE-2020-1954

What is CVE-2020-1954?

Apache CXF, a popular framework for building web services, can be exploited when the 'createMBServerConnectorFactory' property of the default InstrumentationManagerImpl is enabled. This vulnerability allows attackers on the same host to carry out a man-in-the-middle attack, where they can connect to the JMX registry and redirect communication to a malicious server. Consequently, sensitive information sent and received over JMX could be compromised as the attacker acts as a proxy, intercepting data streams.

References