CVE-2018-1297

Published: Feb 13, 2018

Modified: Sep 17, 2024

PUBLISHED

Description

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.

Vendor	Product	Versions
Apache Software Foundation	Apache JMeter	affected `2.x` affected `3.x`

References

[www-announce] 20180211 CVE-2018-1297: Apache JMeter uses an unsecure RMI connection in Distributed mode

mailing-list

x_refsource_MLIST

https://bz.apache.org/bugzilla/show_bug.cgi?id=62039

x_refsource_CONFIRM

[jmeter-issues] 20190609 [Bug 62039] [CVE-2018-1287 & CVE-2018-1297] Distributed testing : Secure RMI connection by SSL and certificate and bind to host defined "java.rmi.server.hostname" system property

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2018-1297

Description

Affected Products

References