VULNERABILITY INTELLIGENCE
CVE-2018-1287
CVSS score9.8 CRITICAL
EPSS probability3.35%
CISA KEVNot currently listed
Published2018-02-14
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
Primary references
- security@apache.org — Mitigation, Vendor Advisory
- security@apache.org — Third Party Advisory, VDB Entry
- security@apache.org
- af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108