Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

[0day-rubbish] Lightstreamer Server 7.4.8 Unauthenticated JMX jvmtiAgentLoad native code execution (8.1)

Full Disclosure ()1
Read at seclists.org
Part of a story covered by 2 sourcesLightstreamer Server 7.4.8 JMX flaws disclosedMerged summary & timeline
AI summary · grok-4.7Summaries by Vani AI

Researchers disclosed an unauthenticated JMX flaw in Lightstreamer Server 7.4.8 that can load native code in the JVM.

The 0day Rubbish Research Team disclosed an unauthenticated access flaw in Lightstreamer Server 7.4.8 build 3506 with JMS Extender 2.1.0. An anonymous caller can use the JMX inspection console to invoke MBean operations, including loading a native agent into the broker JVM. The report cites CWE-306, CWE-345, CWE-20, CWE-250 and CWE-1188 and scores the issue 8.1. No CVE or in-the-wild exploitation is mentioned.

Key facts
  • Affects Lightstreamer Server 7.4.8 build 3506 with JMS Extender 2.1.0.
  • Unauthenticated JMX access can invoke arbitrary MBean operations.
  • Native agent loading can execute code inside the broker JVM.
  • Scored 8.1; the post names no CVE.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
lightstreamerjmxrceunauthenticated0dayjvm
Vendors
Lightstreamer
Products
Lightstreamer ServerJMS Extender
Organizations
0day Rubbish Research Team

From the original article

Posted by disclosure via Fulldisclosure on Sep 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Lightstreamer Server 7. 4. 8 build 3506 (with JMS Extender 2.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.