WaratekVRT Sign in

Critical Org.apache.jmeter ApacheJMeter CVEs

3 CVEs, 1 protected by Waratek

Reset
More filters (2)
Columns
Vendor org.apache.jmeter✕Product ApacheJMeter✕
Overview 3 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
3matches 1protected33.3% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 33.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 66.7%
Critical 3 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 33.3% partly blocked 0 0.0% not blocked 2 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 100.0%
split by peak 2 / month
No exploit published: 2Protected by Waratek: 1 Critical: 3 not blocked: 2blocked by ARMR today: 1 No public exploit: 3
Feb 182 No exploit published2 Critical2 not blocked2 No public exploit2 Mar 180 Apr 180 May 180 Jun 180 Jul 180 Aug 180 Sep 180 Oct 180 Nov 180 Dec 180 Jan 190 Feb 190 Mar 191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1
Mar 18May 18Jul 18Sep 18Nov 18Jan 19Mar 19
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-0187 Critical 2019-03-06 Protected by Waratek No public exploit Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.
CVE-2018-1287 Critical 2018-02-14 No exploit published No public exploit In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
CVE-2018-1297 Critical 2018-02-13 No exploit published No public exploit When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.