PT-2018-11503 · Apache+1 · Apache Jmeter+1

Publicado 2018-02-13 · Atualizado 2022-05-13 · CVE-2018-1297

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache JMeter versions 2.x through 3.x

Description The issue concerns an unsecured RMI connection used by Apache JMeter when Distributed Test is enabled. This could potentially allow an attacker to access JMeterEngine and send unauthorized code.

Recommendations For Apache JMeter versions 2.x through 3.x, consider securing the RMI connection to prevent unauthorized access. As a temporary workaround, restrict the use of Distributed Test mode until a secure connection can be established.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2018-1297

GHSA-7V85-6HV2-RWGW

Produtos afetados

Apache Jmeter

Debian

Referências · 18

• https://github.com/apache/jmeter · Nota
• https://github.com/apache/jmeter/issues/4677 · Nota
• https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E · Nota
• https://bz.apache.org/bugzilla/show_bug.cgi?id=62039 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1297 · Nota de Segurança
• http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-1297 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1297 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2018-1297 · Aviso do Fabricante
• https://packages.debian.org/src:jakarta-jmeter · Nota
• https://osv.dev/vulnerability/CVE-2018-1297 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/jakarta-jmeter · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7v85-6hv2-rwgw · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-1297 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1297 · Aviso do Fabricante