cve.bz

CVE-2020-13931

9.8 criticalEPSS 3.7%

Critical (9.8) in apache tomee. EPSS 3.7% chance of exploitation in the next 30 days. Fixed in org.apache.tomee:apache-tomee 7.0.9, 7.1.4, 8.0.4.

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
3.7% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-mp28-rq7g-qx62Mavenorg.apache.tomee:apache-tomee>=8.0.0 <8.0.48.0.4
GHSA-mp28-rq7g-qx62Mavenorg.apache.tomee:apache-tomee>=7.1.0 <7.1.47.1.4
GHSA-mp28-rq7g-qx62Mavenorg.apache.tomee:apache-tomee<7.0.97.0.9

References

Check your stackJSON