apache/jmeter · Security
Missing certificate validation in Apache JMeter
- GHSA ID
- GHSA-7v85-6hv2-rwgw
- CVE ID
- CVE-2018-1297
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
CWEs
- CWE-319 · Cleartext Transmission of Sensitive Information
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1297 ↗
- https://bz.apache.org/bugzilla/show_bug.cgi?id=62039 ↗
- https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b@%3Cissues.jmeter.apache.org%3E ↗
- http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E ↗
- https://github.com/apache/jmeter/issues/4677 ↗
- https://github.com/advisories/GHSA-7v85-6hv2-rwgw ↗