VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Dec 18, 2020· Updated Jun 17, 2026

CVE-2020-13931

CVE-2020-13931

Description

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomee:apache-tomeeMaven
>= 8.0.0, < 8.0.48.0.4
org.apache.tomee:apache-tomeeMaven
>= 7.1.0, < 7.1.47.1.4
org.apache.tomee:apache-tomeeMaven
< 7.0.97.0.9

Affected products

7
  • Apache/TomEE5 versions
    cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*range: >=1.0.0,<=1.7.5
    • cpe:2.3:a:apache:tomee:7.0.0:m1:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomee:7.0.0:m2:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomee:7.0.0:m3:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomee:8.0.0:m1:*:*:*:*:*:*
  • Apache/TomEEdescription
  • ghsa-coords
    pkg:maven/org.apache.tomee/apache-tomee
    Range: >= 8.0.0, < 8.0.4

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.