CVE-2020-13920
mediumPriorität · verfolgen · 26OT-Risiko · erhöhtEPSS 0.045 · 92. PerzentilDEEUUSEPSS · bewertet 2026-10-27
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (11)
Betroffene Produkte und Versionsbereiche.
- oracle communications diameter signaling router8.0.0 → 8.2.2nvdUScpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
- oracle flexcube private banking= 12.0.0nvdUScpe:2.3:a:oracle:flexcube_private_banking:*:*:*:*:*:*:*:*
- oracle flexcube private banking= 12.1.0nvdUScpe:2.3:a:oracle:flexcube_private_banking:*:*:*:*:*:*:*:*
- Maven org.apache.activemq:activemq-parent< 5.15.12osvUSpkg:maven/org.apache.activemq/activemq-parent
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2023-2970Apache ActiveMQ: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2020-09-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache ActiveMQ ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- GHSA-xgrx-xpv2-6vp4Improper Authentication in Apache ActiveMQ2022-02-09ghsa · osvUS
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- BIT-activemq-2020-139202025-12-03vendor · osvUS
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (28)
Externe Belege — Patches, Meldungen, Analysen.
- http://activemq.apache.org/security-advisories.data/CVE-2020-13920-announcement.txtcnnvd
- https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3Ecnnvd
- https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3Ecnnvd
- https://lists.debian.org/debian-lts-announce/2020/10/msg00013.htmlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-13920cnnvd
- https://packetstormsecurity.com/files/163798/Red-Hat-Security-Advisory-2021-3140-01.htmlcnnvd
- https://packetstormsecurity.com/files/163872/Red-Hat-Security-Advisory-2021-3205-01.htmlcnnvd
- https://vigilance.fr/vulnerability/Apache-ActiveMQ-privilege-escalation-via-LocateRegistry-createRegistry-33504cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan