CVE-2020-11969 Missing Authentication for Critical Function in Apache TomEE

What is CVE-2020-11969?

CVE-2020-11969 is a critical missing authorization vulnerability in Apache TomEE, published on 15 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.

Weakness: CWE-306

Which versions are affected by CVE-2020-11969?

8 open source packages ship an affected version, including org.apache.tomee:tomee. It affects 1 product.

Products include Apache Tomee.

How do I fix CVE-2020-11969?

Upgrade org.apache.tomee:tomee to a fixed version for your release line: 1.7.6, 7.0.8, 7.1.3 or 8.0.2.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-11969 being exploited?

There is no known exploitation of CVE-2020-11969 in the wild and no public exploit code.

Other vulnerabilities in Apache TomEE

• CVE-2020-13931 Remote code execution in Apache TomEE Critical 9.8
• CVE-2019-13990 XML external entity injection in Terracotta Quartz Scheduler Critical 9.8
• CVE-2016-0779 Deserialization in n/a Critical 9.8
• CVE-2019-17359 Out-of-Memory Error in Bouncy Castle Crypto High 7.5
• CVE-2018-8031 Apache TomEE console vulnerable to Cross-site Scripting Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-836g-5fr5-fgcr.