Critical severity · published Feb 13, 2018
CVE-2018-1297
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection
9.8
CVSS
11.5%
EPSS
No
On KEV
Description
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)11.5% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JM
Jmeter · Apache
2.1; 2.2; 2.3; 2.3.1; 2.3.2; 2.3.3; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1297
Mailing List
http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E
Issue Tracking
https://bz.apache.org/bugzilla/show_bug.cgi?id=62039
lists.apache.org
https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E
More from Jmeter
9.9
CVE-2021-21345
XStream is vulnerable to a Remote Command Execution attack
9.8
CVE-2021-21350
XStream is vulnerable to an Arbitrary Code Execution attack
9.8
CVE-2021-21344
XStream is vulnerable to an Arbitrary Code Execution attack
9.8
CVE-2021-21346
XStream is vulnerable to an Arbitrary Code Execution attack
9.8
CVE-2021-21347
XStream is vulnerable to an Arbitrary Code Execution attack