Authentication mechanism absence or evasion In org.apache.tomee:tomee
Description
Missing Authentication for Critical Function in Apache TomEE If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 7.0.0-m1, 7.1.3, 8.0.2 | ||
maven | 8.0.2, 7.1.3, 7.0.8, 1.7.6 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4. 5. 6.