CVE-2019-12418
UNKNOWN
Published 2019-12-23T17:12:43
Actions:
No CVSS data available
Description
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
Available Exploits
No exploits available for this CVE.
Related News
No news articles found for this CVE.
Affected Products
Affected Versions:
References
HackerOne Reports
Tomcat examples available for public, Disclosure Apache Tomcat version, Critical/High/Medium CVE
Medium
pvm
U.S. Dept Of Defense
Information Exposure Through an Error Message
Published: 2019-12-23T17:12:43
Last Modified: 2024-08-04T23:17:40.118Z
Copied to clipboard!