cve.bz

CVE-2020-11969

9.8 criticalEPSS 4.2%

Critical (9.8) in apache tomee. EPSS 4.2% chance of exploitation in the next 30 days. Fixed in org.apache.tomee:tomee 1.7.6, 7.0.8, 7.1.3.

If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
4.2% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE
CWE-306
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-836g-5fr5-fgcrMavenorg.apache.tomee:tomee>=8.0.0-M1 <8.0.28.0.2
GHSA-836g-5fr5-fgcrMavenorg.apache.tomee:tomee>=7.1.0 <7.1.37.1.3
GHSA-836g-5fr5-fgcrMavenorg.apache.tomee:tomee>=7.0.0-M1 <7.0.87.0.8
GHSA-836g-5fr5-fgcrMavenorg.apache.tomee:tomee>=1.0.0 <1.7.61.7.6

References

Check your stackJSON