Critical severity · published Feb 14, 2018
CVE-2018-1287
In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host
9.8
CVSS
3.4%
EPSS
No
On KEV
Description
In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JM
Jmeter · Apache
2.1; 2.2; 2.3; 2.3.1; 2.3.2; 2.3.3; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1287
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1287
Mitigation
http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpYsFx1%2Brwz1A%3Dmc7wAgbDHARyj1VrWNg41y9OySuL1mqw%40mail.gmail.com%3E
Third Party Advisory
http://www.securityfocus.com/bid/103068
lists.apache.org
https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E
More from Jmeter
9.9
CVE-2021-21345
XStream is vulnerable to a Remote Command Execution attack
9.8
CVE-2021-21350
XStream is vulnerable to an Arbitrary Code Execution attack
9.8
CVE-2021-21344
XStream is vulnerable to an Arbitrary Code Execution attack
9.8
CVE-2021-21346
XStream is vulnerable to an Arbitrary Code Execution attack
9.8
CVE-2021-21347
XStream is vulnerable to an Arbitrary Code Execution attack