NetSight
IP …
medium5.3

CVE-2020-1954

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus.

Impact

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.

Affected products

VendorProductAffected versions
ApacheCxf
before 3.2.13
from 3.3.0 before 3.3.6
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2
OracleCommunications Element Manager
from 8.2.0 through 8.2.2
OracleCommunications Session Report Manager
from 8.2.0 through 8.2.2
OracleEnterprise Manager Base Platform
Version 13.2.1.0
OraclePeoplesoft Enterprise Peopletools
Version 8.56
NetappOncommand Workflow Automation
All versions
NetappSnapmanager
All versions
OracleCommunications Diameter Signaling Router Idih\
from 8.0.0 through 8.2.2
OracleCommunications Session Route Manager
from 8.2.0 through 8.2.2

References