CVE-2020-13931 Remote code execution in Apache TomEE

What is CVE-2020-13931?

CVE-2020-13931 is a critical vulnerability in Apache TomEE, published on 17 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.

Which versions are affected by CVE-2020-13931?

6 open source packages ship an affected version, including org.apache.tomee:apache-tomee. It affects 1 product.

Products include Apache Tomee.

How do I fix CVE-2020-13931?

Upgrade org.apache.tomee:apache-tomee to a fixed version for your release line: 7.0.9, 7.1.4 or 8.0.4.

Is CVE-2020-13931 being exploited?

There is no known exploitation of CVE-2020-13931 in the wild and no public exploit code.

Other vulnerabilities in Apache TomEE

• CVE-2020-11969 Missing Authentication for Critical Function in Apache TomEE Critical 9.8
• CVE-2019-13990 XML external entity injection in Terracotta Quartz Scheduler Critical 9.8
• CVE-2016-0779 Deserialization in n/a Critical 9.8
• CVE-2019-17359 Out-of-Memory Error in Bouncy Castle Crypto High 7.5
• CVE-2018-8031 Apache TomEE console vulnerable to Cross-site Scripting Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mp28-rq7g-qx62.