CVE-2020-11969

—

CVSS 3.1

9.8 critical

EPSS

4%p90

Published

Jun 15, 2020 (Jun 15, 2020)

Modified

Jun 17, 2026

Description

If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.

Vendors: apache
Products: tomee
Weakness: CWE-306
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.1%)

In the news0 stories

No ingested article mentions this CVE yet.