CVE-2019-12418: High severity IBM Data Risk Manager vulnerability
A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attacker without access to the Tomcat process or configuration files could be able to manipulate the RMI registry to perform a man-in-the-middle attack. The attacker could then capture user names and passwords used to access the JMX interface and gain complete control over the Tomcat instance.
Other sources
Apache Tomcat could allow a local attacker to gain elevated privileges on the system, caused by a flaw when configured with the JMX Remote Lifecycle Listener. By using man-in-the-middle attack techniques, an attacker could exploit this vulnerability to capture user names and passwords used to access the JMX interface and gain elevated privileges.
— IBM
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
When Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
Reference: https://tomcat.apache.org/security-7.html https://tomcat.apache.org/security-8.html http://tomcat.apache.org/security-9.html
Upstream commits: https://github.com/apache/tomcat/commit/bef3f40 https://github.com/apache/tomcat/commit/a91d7db https://github.com/apache/tomcat/commit/1fc9f58
— Red Hat
Affected Software
Remediation
Information
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this Apache Tomcat vulnerability?
The vulnerability ID is CVE-2019-12418.
What is the severity of CVE-2019-12418?
The severity of CVE-2019-12418 is high, with a severity value of 8.4.
How does CVE-2019-12418 impact Apache Tomcat?
CVE-2019-12418 allows a local attacker to manipulate the RMI registry and perform a man-in-the-middle attack to capture usernames.
Which versions of Apache Tomcat are affected by CVE-2019-12418?
Apache Tomcat versions 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, and 7.0.0 to 7.0.97 are affected by CVE-2019-12418.
How can I fix CVE-2019-12418 in Apache Tomcat?
To fix CVE-2019-12418, update to Apache Tomcat version 7.0.98, 8.5.48, or 9.0.29, depending on the applicable version.