Vulnerability Description
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 7.0.0, <= 7.0.97 |
| Debian | Debian Linux | 8.0 |
| Oracle | Workload Manager | 12.2.0.1 |
| Canonical | Ubuntu Linux | 16.04 |
| Opensuse | Leap | 15.1 |
| Netapp | Oncommand System Manager | >= 3.0.0, <= 3.1.3 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.htmlMailing ListThird Party Advisory
- https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b982Mailing ListVendor Advisory
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f67412
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a148555
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d
- https://lists.debian.org/debian-lts-announce/2020/01/msg00024.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/03/msg00029.htmlMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/Dec/43Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202003-43Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200107-0001/Third Party Advisory
- https://support.f5.com/csp/article/K10107360?utm_source=f5support&%3Butm_medi
- https://usn.ubuntu.com/4251-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4596Third Party Advisory
FAQ
What is CVE-2019-12418?
CVE-2019-12418 is a vulnerability with a CVSS score of 7.0 (HIGH). When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration fi...
How severe is CVE-2019-12418?
CVE-2019-12418 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-12418?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat, Debian Debian Linux, Oracle Workload Manager, Canonical Ubuntu Linux, Opensuse Leap.