PT-2018-11503 · Apache+1 · Apache Jmeter+1

Published 2018-02-13 · Updated 2022-05-13 · CVE-2018-1297

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache JMeter versions 2.x through 3.x

Description The issue concerns an unsecured RMI connection used by Apache JMeter when Distributed Test is enabled. This could potentially allow an attacker to access JMeterEngine and send unauthorized code.

Recommendations For Apache JMeter versions 2.x through 3.x, consider securing the RMI connection to prevent unauthorized access. As a temporary workaround, restrict the use of Distributed Test mode until a secure connection can be established.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2018-1297

GHSA-7V85-6HV2-RWGW

Affected Products

Apache Jmeter

Debian

References · 18

• https://bz.apache.org/bugzilla/show_bug.cgi?id=62039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1297 · Security Note
• http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1297 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1297 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1297 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1297 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/jakarta-jmeter · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7v85-6hv2-rwgw · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1297 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1297 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1297 · Vendor Advisory
• https://github.com/apache/jmeter · Note
• https://github.com/apache/jmeter/issues/4677 · Note
• https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E · Note