Not rated

CVE-2019-0187 Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options)

Description

Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.

Affected products and versions

Product	Affected versions	Fixed in
Apache JMeter	Versions not published

References

107219 www.securityfocus.com
[jmeter-user] 20190302 [SECURITY] CVE-2019-0187: Apache JMeter Missing client auth for RMI connection when distributed test is used mail-archives.apache.org

Timeline

Published March 6, 2019
Last modified September 16, 2024

The 3 CVEs of Apache JMeter →

CVE-2018-1287 In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard… Not rated CVE-2018-1297 When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection Not rated

Track this CVE

CVE-2019-0187 Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options)

Description

Affected products and versions

References

Timeline

Other CVEs of Apache JMeter