Critical severityNVD Advisory· Published Mar 6, 2019· Updated Sep 16, 2024
CVE-2019-0187
CVE-2019-0187
Description
Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.jmeter:ApacheJMeterMaven | < 5.1 | 5.1 |
Affected products
2- Apache Software Foundation/Apache JMeterv5Range: Apache JMeter 4.0 to 5.0
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-wg37-7mrv-cfwmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-0187ghsaADVISORY
- mail-archives.apache.org/mod_mbox/jmeter-user/201903.mbox/%3CCAH9fUpaUQaFbgY1Zh4OvKSL4wdvGAmVt%2Bn4fegibDoAxK5XARw%40mail.gmail.com%3Eghsamailing-listx_refsource_MLISTWEB
- www.securityfocus.com/bid/107219ghsavdb-entryx_refsource_BIDWEB
News mentions
0No linked articles in our index yet.