CVE-2020-24231 Missing authorization in n/a
Attackers can access unauthenticated JMX interfaces to retrieve system information and execute arbitrary code via remote MBean installation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24231?
CVE-2020-24231 is a critical missing authorization vulnerability in n/a, published on 5 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Symmetric DS <3.12.0 uses mx4j to provide access to JMX over HTTP. mx4j, by default, has no auth and is available on all interfaces. An attacker can interact with JMX: get system info, and invoke MBean methods. It is possible to install additional MBeans from a remote host using MLet that leads to arbitrary code execution.
Which versions are affected by CVE-2020-24231?
It affects 1 product.
Products include Jumpmind Symmetricds.
How do I fix CVE-2020-24231?
No fix has been published for CVE-2020-24231 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-24231 being exploited?
There is no known exploitation of CVE-2020-24231 in the wild and no public exploit code.
Sources
Also known as GHSA-2q3x-j945-f36w.