What is GHSA-7v85-6hv2-rwgw?

GHSA-7v85-6hv2-rwgw is a security advisory published by GitHub Security Advisories with Critical severity. Missing certificate validation in Apache JMeter

Which CVE IDs does GHSA-7v85-6hv2-rwgw cover?

GHSA-7v85-6hv2-rwgw covers the following CVE IDs: CVE-2018-1297. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7v85-6hv2-rwgw?

GHSA-7v85-6hv2-rwgw has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-7v85-6hv2-rwgw?

GHSA-7v85-6hv2-rwgw affects 1 product, including: maven/org.apache.jmeter:ApacheJMeter:\u003c 4.0.

GHSA-7v85-6hv2-rwgwCriticalCVSS 9.8

Missing certificate validation in Apache JMeter

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

February 2, 2023

🔗 CVE IDs covered (1)

CVE-2018-1297 →

📋 Description

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.

🎯 Affected products1

maven/org.apache.jmeter:ApacheJMeter:< 4.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-1297
https://bz.apache.org/bugzilla/show_bug.cgi?id=62039
https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b@%3Cissues.jmeter.apache.org%3E
http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E
https://github.com/apache/jmeter/issues/4677
https://github.com/advisories/GHSA-7v85-6hv2-rwgw