Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.tomee:apache-tomee

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenPublished

    Remote code execution in Apache TomEE

    CVE-2020-13931 · GHSA-mp28-rq7g-qx62

    Affected
    • Maven org.apache.tomee:apache-tomee >= 8.0.0, < 8.0.4; >= 7.1.0, < 7.1.4; < 7.0.9
    Fixed in
    7.0.97.1.48.0.4· Vendor fix available
    Issue
    If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.

    Recommended action: Upgrade to 8.0.4, 7.1.4 or 7.0.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →