CVE-2018-1287

Critical

In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could…

apache·NVD-CWE-noinfo·Published 2018-02-14

CVSS

9.8

EPSS

0.04

KEV

Exploits

cve.orgen

213 chars

NVDen

213 chars

OSV.deven

434 chars

In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. This only affect those running in Distributed mode. In distributed mode, JMeter makes an architectural assumption that it is operating on a 'safe' network. i.e. everyone with access to the network is considered trusted.

GHSAen

434 chars

NVDes

247 chars

En Apache JMeter 2.X y 3.X, al emplear solo Distributed Test (basado en RMI), el servidor jmeter enlaza el registro RMI al host de caracteres comodín. Esto podría permitir que un atacante obtenga acceso a JMeterEngine y envíe código no autorizado.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	7.5	10.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
3.0	Primary	NVD	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1	Secondary	GHSA	9.8	—	—	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H