CVE-2020-13920
mediumpriority · track · 26OT risk · elevatedEPSS 0.045 · 92 %ileDEEUUSEPSS · scored 2026-10-27
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (11)
Products and version ranges known to be affected.
- oracle communications diameter signaling router8.0.0 → 8.2.2nvdUScpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
- oracle flexcube private banking= 12.0.0nvdUScpe:2.3:a:oracle:flexcube_private_banking:*:*:*:*:*:*:*:*
- oracle flexcube private banking= 12.1.0nvdUScpe:2.3:a:oracle:flexcube_private_banking:*:*:*:*:*:*:*:*
- Maven org.apache.activemq:activemq-parent< 5.15.12osvUSpkg:maven/org.apache.activemq/activemq-parent
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-2970Apache ActiveMQ: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2020-09-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache ActiveMQ ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- GHSA-xgrx-xpv2-6vp4Improper Authentication in Apache ActiveMQ2022-02-09ghsa · osvUS
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
- BIT-activemq-2020-139202025-12-03vendor · osvUS
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (28)
External citations — patches, advisories, analysis.
- http://activemq.apache.org/security-advisories.data/CVE-2020-13920-announcement.txtcnnvd
- https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3Ecnnvd
- https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3Ecnnvd
- https://lists.debian.org/debian-lts-announce/2020/10/msg00013.htmlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-13920cnnvd
- https://packetstormsecurity.com/files/163798/Red-Hat-Security-Advisory-2021-3140-01.htmlcnnvd
- https://packetstormsecurity.com/files/163872/Red-Hat-Security-Advisory-2021-3205-01.htmlcnnvd
- https://vigilance.fr/vulnerability/Apache-ActiveMQ-privilege-escalation-via-LocateRegistry-createRegistry-33504cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan