CVE-2020-11980

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role c...

PT-2020-12965

Name of the Vulnerable Software and Affected Versions Apache Karaf versions prior to 4.2.9 Description The issue concerns JMX authentication and authorization in Karaf, where a user with a "viewer" role can invoke certain methods, potentially leading to a SSRF style attack and privilege escalatio...

CVE-2020-11980: Server-Side Request Forgery (SSRF)

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role c...

PT-2016-6232

Name of the Vulnerable Software and Affected Versions Aternity versions prior to 9.0.1 Description The issue concerns the web server in Aternity, which does not require authentication for loading of Java MBeans using getMBeansFromURL. This allows remote attackers to execute arbitrary Java code by...

CVE-2016-5062: Incorrect Resource Transfer Between Spheres

The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans...