cxf: JMX integration is vulnerable to a MITM attack

🗓️ 04 Nov 2020 19:24:13Reported by RedHatType

CXF JMX integration is MITM vulnerable if createMBServerConnectorFactory is not disabled, enabling local rebinding and data proxy.

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	7 Oct 202020:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	29 Apr 202502:26	–	ibm
IBM Security Bulletins	Security Bulletin:IBM TRIRIGA Application Platform discloses CVE-2020-1954	30 Aug 202216:50	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Apache CXF, which is shipped with IBM Tivoli Network Manager (CVE-2020-1954).	30 Jul 202009:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance uses components with known vulnerabilities (CVE-2021-22696, CVE-2021-30468, CVE-2020-1954)	21 Jun 202320:31	–	ibm
IBM Security Bulletins	Security Bulletin: Apache CXF vulnerability identified in IBM Tivoli Application Dependency Discovery Manager (CVE-2020-1954)	22 Oct 202012:36	–	ibm
BDU FSTEC	The vulnerability of the Apache CXF web service framework, related to connection establishment errors, allows attackers to gain unauthorized access to protected information.	17 Nov 202000:00	–	bdu_fstec
CNVD	Apache CXF Information Disclosure Vulnerability (CNVD-2020-29873)	2 Apr 202000:00	–	cnvd
CVE	CVE-2020-1954	1 Apr 202020:07	–	cve
Cvelist	CVE-2020-1954	1 Apr 202020:07	–	cvelist

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2020-1954
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-1954
cve	www.cve.org/CVERecord

28 Jun 2026 12:33Current

7.4High risk

Vulners AI Score7.4

CVSS 22.9

CVSS 3.15.3

EPSS0.06147