org.apache.openejb:apache-tomee (>=1.6.0.1, <=1.6.0.2), org.apache.openejb:arquillian-tomee-codi-tests (>=1.6.0.1, <=1.6.0.2) +8 more potentially affected by CVE-2021-30639 via org.apache.tomcat:tomcat (7.0.53)

org.apache.tomcat:tomcat MAVEN version 7.0.53 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - org.apache.openejb:apache-tomee =1.6.0.1, =1.6.0.1, =1.6.0.1, =1.6.0.1, =1.6.0.1, =1.6.0.1, =1.6.0.1, =1.6.0.1...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.44), org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.10) +10 more potentially affected by CVE-2021-30639 via org.apache.tomcat:tomcat (>=9.0.10, <=9.0.44)

org.apache.tomcat:tomcat MAVEN version =9.0.10, =9.0.31, =3.3.6, =3.3.6, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =5.22.2, =5.24.1 Source cves: CVE-2021-30639 Source advisory: GHSA-44QP-QHFV-C7F6...

Apache TomEE RCE

The vulnerability of the Apache TomEE application server is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges, execute arbitrary code, or cause service failures...

Apache TomEE JMX Vulnerability (CVE-2020-13931)

Apache TomEE is prone to a misconfiguration vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

Missing Authentication Due To Incorrect Configuration

Apache Tomee openejb-core has missing authentication. The vulnerability exists due to an incomplete fix of CVE-2020-11969 where when embedded ActiveMQ broker with URI setting useJMX=true is used, it causes JMX port to open on TCP port 1099, which does not include authentication...

CVE-2020-13931

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

CVE-2020-13931

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

Input validation

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

Apache TomEE Authorization Issues Vulnerability

Apache TomEE is the United States Apache Software Apache Foundation of a lightweight Java EE application server . A security vulnerability exists in Apache TomEE versions 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5, which originates from the use of the embedded ActiveMQ proxy...

org.apache.tomee.jakarta:apache-tomee (9.0.0-m1), org.apache.tomee:arquillian-tomee-codi-tests (>=8.0.0, <=8.0.3) +8 more potentially affected by CVE-2020-13931 via org.apache.tomee:apache-tomee (>=8.0.0, <=8.0.3)

org.apache.tomee:apache-tomee MAVEN version =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.3 Source cves: CVE-2020-13931 Source advisory: MEND:CVE-2020-13931...

CVE-2020-13931

CVE-2020-13931 : Apache TomEE with embedded ActiveMQ broker and a misconfigured broker config can open a JMX port (TCP 1099) without authentication, for TomEE versions 8.0.0-M1–8.0.3, 7.1.0–7.1.3, 7.0.0-M1–7.0.8, and 1.0.0–1.7.5. This edge case was not covered by the prior fix for CVE-2020-11969,...

org.apache.tomee:arquillian-tomee-codi-tests (>=7.0.0-m1, <=7.0.8), org.apache.tomee:arquillian-tomee-config-tests (>=7.0.0-m1, <=7.0.8) +6 more potentially affected by CVE-2020-13931 via org.apache.tomee:apache-tomee (>=7.0.0-m1, <=7.0.8)

org.apache.tomee:apache-tomee MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.0-m1, =7.0.8 Source cves: CVE-2020-13931 Source advisory: MEND:CVE-2020-13931...

CVE-2020-13931

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

CVE-2020-13931

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

org.apache.tomee:arquillian-tomee-codi-tests (>=7.1.0, <=7.1.3), org.apache.tomee:arquillian-tomee-config-tests (>=7.1.0, <=7.1.3) +6 more potentially affected by CVE-2020-13931 via org.apache.tomee:apache-tomee (>=7.1.0, <=7.1.3)

org.apache.tomee:apache-tomee MAVEN version =7.1.0, =7.1.0, =7.1.0, =7.1.0, =7.1.0, =7.1.0, =7.1.0, =7.1.0, =7.1.0, =7.1.3 Source cves: CVE-2020-13931 Source advisory: MEND:CVE-2020-13931...

Apache TomEE authorization issue vulnerability

Apache TomEE is the United States Apache Software Apache Foundation of a lightweight Java EE application server . A security vulnerability exists in Apache TomEE versions 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5, which originates from the use of the embedded ActiveMQ proxy...

PT-2020-13787

Name of the Vulnerable Software and Affected Versions Apache TomEE versions 1.0.0 through 1.7.5 Apache TomEE versions 7.0.0-M1 through 7.0.8 Apache TomEE versions 7.1.0 through 7.1.3 Apache TomEE versions 8.0.0-M1 through 8.0.3 Description The issue arises when Apache TomEE is configured to use t...

CVE-2020-13931: Undefined Security Weakness

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

Missing Authentication

Apache Tomee openejb-core has missing authentication. When embedded ActiveMQ broker with URI setting useJMX=true is used, it causes JMX port to open on TCP port 1099, which does not include authentication...

Apache TomEE Authorization Issues Vulnerability

Apache TomEE is the United States Apache Software Apache Software Foundation of a lightweight Java EE application server . An authorization issue vulnerability exists in Apache TomEE. An attacker can exploit the vulnerability by sending a specially crafted request using the 'useJMX=true' paramete...