Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.tomee:tomee

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenPublished

    Missing Authentication for Critical Function in Apache TomEE

    CVE-2020-11969 · GHSA-836g-5fr5-fgcr

    Affected
    • Maven org.apache.tomee:tomee >= 8.0.0-M1, <= 8.0.1; >= 7.1.0, <= 7.1.2; >= 7.0.0-M1, <= 7.0.7; >= 1.0.0, <= 1.7.5
    Fixed in
    7.0.88.0.27.1.31.7.6· Vendor fix available
    Issue
    If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.

    Recommended action: Upgrade to 8.0.2, 7.1.3, 7.0.8 or 1.7.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →