CVE-2020-13920

🗓️ 10 Sep 2020 00:00:00Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 202 Views

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: Apache ActiveMQ Vulnerability Affects IBM Control Center (CVE-2020-13920)	15 Jan 202122:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache ActiveMQ affects IBM Sterling Secure Proxy (CVE-2020-13920)	8 Jan 202123:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management	2 May 202412:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Directory Integrator is affected by multiple security vulnerabilities	22 Jun 202316:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache ActiveMQ affect IBM Operations Analytics Predictive Insights (CVE-2020-11998, CVE-2020-13920)	15 Oct 202018:25	–	ibm
FreeBSD	nexus2-oss -- Apache ActiveMQ JMX vulnerability	28 Dec 202000:00	–	freebsd
CNVD	Apache ActiveMQ effect authentication vulnerability	12 Sep 202000:00	–	cnvd
Cvelist	CVE-2020-13920	10 Sep 202000:00	–	cvelist
Debian	[SECURITY] [DLA 2400-1] activemq security update	7 Oct 202022:41	–	debian
Debian	[SECURITY] [DLA 3657-1] activemq security update	20 Nov 202321:14	–	debian

NVD

Vulners

Node

apache activemqRange<5.15.12

Node

oracle communications_diameter_signaling_routerRange8.0.0–8.2.2

oracle flexcube_private_bankingMatch12.0.0

oracle flexcube_private_bankingMatch12.1.0

Node

debian debian_linuxMatch9.0

[
  {
    "vendor": "n/a",
    "product": "Apache ActiveMQ",
    "versions": [
      {
        "version": "Apache ActiveMQ version prior to 5.15.12",
        "status": "affected"
      }
    ]
  }
]

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2020/10/msg00013.html
lists	www.lists.debian.org/debian-lts-announce/2023/11/msg00013.html
oracle	www.oracle.com/security-alerts/cpuoct2020.html
lists	www.lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E
activemq	www.activemq.apache.org/security-advisories.data/CVE-2020-13920-announcement.txt
lists	www.lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E

17 Jun 2026 02:53Current

5.8Medium risk

Vulners AI Score5.8

CVSS 24.3

CVSS 3.15.9

EPSS0.04561

CWE-306