9.8

CVE-2018-1297

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Jmeter Version 2.1
Apache ≫ Jmeter Version 2.2
Apache ≫ Jmeter Version 2.3
Apache ≫ Jmeter Version 2.3.1
Apache ≫ Jmeter Version 2.3.2
Apache ≫ Jmeter Version 2.3.3
Apache ≫ Jmeter Version 2.3.3 Update rc1
Apache ≫ Jmeter Version 2.3.3 Update rc2
Apache ≫ Jmeter Version 2.3.4
Apache ≫ Jmeter Version 2.3.4 Update rc1
Apache ≫ Jmeter Version 2.3.4 Update rc2
Apache ≫ Jmeter Version 2.3.4 Update rc3
Apache ≫ Jmeter Version 2.4
Apache ≫ Jmeter Version 2.5
Apache ≫ Jmeter Version 2.5 Update rc1
Apache ≫ Jmeter Version 2.5 Update rc2
Apache ≫ Jmeter Version 2.5 Update rc3
Apache ≫ Jmeter Version 2.5.1
Apache ≫ Jmeter Version 2.5.1 Update rc1
Apache ≫ Jmeter Version 2.5.1 Update rc2
Apache ≫ Jmeter Version 2.5.1 Update rc3
Apache ≫ Jmeter Version 2.6
Apache ≫ Jmeter Version 2.6 Update rc1
Apache ≫ Jmeter Version 2.6 Update rc2
Apache ≫ Jmeter Version 2.7
Apache ≫ Jmeter Version 2.7 Update rc1
Apache ≫ Jmeter Version 2.7 Update rc2
Apache ≫ Jmeter Version 2.7 Update rc3
Apache ≫ Jmeter Version 2.8
Apache ≫ Jmeter Version 2.8 Update rc1
Apache ≫ Jmeter Version 2.8 Update rc2
Apache ≫ Jmeter Version 2.9
Apache ≫ Jmeter Version 2.9 Update rc1
Apache ≫ Jmeter Version 2.9 Update rc2
Apache ≫ Jmeter Version 2.9 Update rc3
Apache ≫ Jmeter Version 2.10 Update rc1
Apache ≫ Jmeter Version 2.10 Update rc2
Apache ≫ Jmeter Version 2.11
Apache ≫ Jmeter Version 2.11 Update rc1
Apache ≫ Jmeter Version 2.11 Update rc2
Apache ≫ Jmeter Version 2.12
Apache ≫ Jmeter Version 2.12 Update rc1
Apache ≫ Jmeter Version 2.12 Update rc2
Apache ≫ Jmeter Version 2.13
Apache ≫ Jmeter Version 2.13 Update rc1
Apache ≫ Jmeter Version 2.13 Update rc2
Apache ≫ Jmeter Version 3.0
Apache ≫ Jmeter Version 3.0 Update rc1
Apache ≫ Jmeter Version 3.0 Update rc2
Apache ≫ Jmeter Version 3.0 Update rc3
Apache ≫ Jmeter Version 3.0 Update rc4
Apache ≫ Jmeter Version 3.0 Update rc5
Apache ≫ Jmeter Version 3.1
Apache ≫ Jmeter Version 3.1 Update rc1
Apache ≫ Jmeter Version 3.1 Update rc2
Apache ≫ Jmeter Version 3.1 Update rc3
Apache ≫ Jmeter Version 3.1 Update rc4
Apache ≫ Jmeter Version 3.2
Apache ≫ Jmeter Version 3.2 Update rc1
Apache ≫ Jmeter Version 3.2 Update rc2
Apache ≫ Jmeter Version 3.2 Update rc3
Apache ≫ Jmeter Version 3.3
Apache ≫ Jmeter Version 3.3 Update rc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 9.91% 0.951
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E
Vendor Advisory
Mailing List
https://bz.apache.org/bugzilla/show_bug.cgi?id=62039
Vendor Advisory
Issue Tracking
https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E