CVE-2019-12418

HighCVSS 7.0/10Last modified Oct 8, 2026

Description

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
Apache Software FoundationApache Tomcat9.0.0.M1 to 9.0.28; 8.5.0 to 8.5.47; 7.0.0 to 7.0.97

References

Timeline

Published
Dec 23, 2019
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-124199.8Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There iCVE-2019-12427.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnCVE-2019-124207.5In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possibleCVE-2019-124218.8When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the auCVE-2019-124227.5Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.CVE-2019-124237.5Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be usCVE-2019-124257.5Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary hostCVE-2019-124265.3an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.CVE-2019-124274.8Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console.CVE-2019-124289.8An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authenticatiCVE-2019-124296.5An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to access labels, statusCVE-2019-12437.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En