Vulnerability in Apache Tomcat
CVE-2019-12418
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.012 (68.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- Apache Tomcat
- Apache Software Foundation Tomcat — versions 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 to 7.0.97
- NetApp Oncommand System Manager
- Oracle Workload Manager — versions 12.2.0.1, 18c, 19c
- Canonical Ubuntu Linux — versions 16.04
- Debian Linux — versions 8.0, 9.0, 10.0
- openSUSE Leap — versions 15.1
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7… (Mailing List, Vendor Advisory)
- www.debian.org/security/2019/dsa-4596 (vendor-advisory, Third Party Advisory)
- seclists.org/bugtraq/2019/Dec/43 (mailing-list, Mailing List, Third Party Advisory)
- security.netapp.com/advisory/ntap-20200107-0001/ (Third Party Advisory)
- support.f5.com/csp/article/K10107360
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html (vendor-advisory, Mailing List, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2020/01/msg00024.html (mailing-list, Mailing List, Third Party Advisory)
- usn.ubuntu.com/4251-1/ (vendor-advisory, Third Party Advisory)
- lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7… (mailing-list)
- lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225… (mailing-list)
Frequently asked questions
- What is CVE-2019-12418?
- CVE-2019-12418 is a high-severity vulnerability in Apache Tomcat. CVSS score: 7.0/10. Published 2019-12-23.
- How severe is CVE-2019-12418?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2019-12418 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.