CVE-2018-1287

In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.

Link	Resource
http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpYsFx1%2Brwz1A%3Dmc7wAgbDHARyj1VrWNg41y9OySuL1mqw%40mail.gmail.com%3E	Mitigation Vendor Advisory
http://www.securityfocus.com/bid/103068	Third Party Advisory VDB Entry
https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b@%3Cissues.jmeter.apache.org%3E

Configuration 1

cpe:2.3:a:apache:jmeter:2.10:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.10:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.11:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.11:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.12:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.12:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.13:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.13:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3.3:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3.3:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3.4:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3.4:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3.4:rc3:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.5.1:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.5.1:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.5.1:rc3:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.5:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.5:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.5:rc3:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.6:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.6:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.7:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.7:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.7:rc3:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.8:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.8:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.9:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.9:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.9:rc3:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.0:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.0:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.0:rc3:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.0:rc4:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.0:rc5:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.2:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.2:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.2:rc3:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.3:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.1:rc1:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.1:rc2:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.1:rc3:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.1:rc4:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.3:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.1:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.11:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.12:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.13:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.2:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.4:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.5:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.6:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.7:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.8:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.9:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.0:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.1:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:3.2:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3.1:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3.2:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3.3:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.3.4:*:*:*:*:*:*:* cpe:2.3:a:apache:jmeter:2.5.1:*:*:*:*:*:*:*

---

Published : 2018-02-14 02:29

Updated : 2019-10-03 12:03

---

NVD link : CVE-2018-1287

Mitre link : CVE-2018-1287

No products.

NVD-CWE-noinfo