$ cve CVE-2020-11998 JSON

CVE-2020-11998

9.8

CRITICAL · CVSS 3.1 · EPSS 48.9% (pctl 99)

Patch early

EPSS 48.9% — above the 10% action threshold.

Description

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	48.89% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	none known
Published	2020-09-10
Last modified	2026-06-17

Affected (7)

Vendor	Product
apache	activemq
oracle	communications diameter signaling router
oracle	communications element manager
oracle	communications session report manager
oracle	communications session route manager
oracle	enterprise repository
oracle	flexcube private banking

References

→ the Explorer · watch your stack · NVD