Vulnerability in Apache Tomcat
CVE-2019-12418
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
EPSS: 0.012 (66.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Tomcat
- Apache Software Foundation Tomcat — versions 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 to 7.0.97
- Netapp Oncommand_system_manager
- Oracle Workload_manager — versions 12.2.0.1, 18c, 19c
- Canonical Ubuntu_linux — versions 16.04
- Debian Debian_linux — versions 8.0, 9.0, 10.0
- Opensuse Leap — versions 15.1
Public proof-of-concept exploits
References
- security@apache.org (x_refsource_CONFIRM, Mailing List, Vendor Advisory)
- security@apache.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- security@apache.org (mailing-list, x_refsource_BUGTRAQ, Mailing List, Third Party Advisory)
- security@apache.org (x_refsource_CONFIRM, Third Party Advisory)
- security@apache.org (x_refsource_CONFIRM)
- security@apache.org (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- security@apache.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2019-12418?
- CVE-2019-12418 is a high-severity vulnerability in Apache Tomcat. CVSS score: 7.0/10. Published 2019-12-23.
- How severe is CVE-2019-12418?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2019-12418 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.