CVE-2019-12418 json
Insufficiently Protected Credentials in Apache Tomcat
published 6y ago modified last mo. also GHSA-hh3j-x4mc-g48r , EUVD-2019-0793
- cvss
- 7.0
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
Patch / fix
- maven org.apache.tomcat.embed:tomcat-embed-core 7.0.99, 8.5.49, 9.0.29
- tomcat9 Debian 14, Debian 13, Debian 12 9.0.31-1
debian advisories DEBIAN-CVE-2019-12418
- tomcat8 Ubuntu 16.04 LTS 8.0.32-1ubuntu1.11
ubuntu advisories UBUNTU-CVE-2019-12418
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- jws5-tomcat jboss enterprise web server 5.3 9.0.30-3.redhat_4.1.el6jws
- jws5-tomcat jboss enterprise web server 5.3 9.0.30-3.redhat_4.1.el7jws
- jws5-tomcat jboss enterprise web server 5.3 9.0.30-3.redhat_4.1.el8jws
- jws5-tomcat-lib jboss enterprise web server 5.3 9.0.30-3.redhat_4.1.el6jws
- jws5-tomcat-lib jboss enterprise web server 5.3 9.0.30-3.redhat_4.1.el7jws
- jws5-tomcat-lib jboss enterprise web server 5.3 9.0.30-3.redhat_4.1.el8jws
- jws5-tomcat-native jboss enterprise web server 5.3 1.2.23-4.redhat_4.el6jws
- jws5-tomcat-native jboss enterprise web server 5.3 1.2.23-4.redhat_4.el7jws
red hat advisories RHSA-2020:1520RHSA-2020:0861
- tomcat SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES 12 SP3-LTSS +8 more 8.0.53-29.27.1
- tomcat6 SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 6.0.53-0.57.16.1
- tomcat SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +1 more 9.0.31-3.25.1
- tomcat SLE Module for Web and Scripting 15 9.0.30-3.34.1
- tomcat SLE Module for Web and Scripting 15 SP1 9.0.30-4.10.1
- tomcat SLES for SAP 12 SP1, SLES 12 SP1-LTSS 8.0.53-10.43.1
suse advisories SUSE-SU-2020:1498-1SUSE-SU-2020:1497-1SUSE-SU-2020:14375-1SUSE-SU-2020:0632-1SUSE-SU-2020:0226-1SUSE-SU-2020:0029-1
- tomcat openSUSE Tumbleweed 9.0.36-8.4
- tomcat10 openSUSE Tumbleweed 10.1.14-1.1
- tomcat openSUSE Leap 15.1 9.0.30-lp151.3.6.1
opensuse advisories openSUSE-SU-2024:11468-1openSUSE-SU-2024:13441-1openSUSE-SU-2020:0038-1
Is CVE-2019-12418 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-12418 updated cvss 7.4
tomcat: local privilege escalation
-
Red Hat BPM Suite 6 tomcat Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 pki-servlet-engine, pki-servlet-4.0-apiaffected: workaround, no fix planned “Will not fix”
-
Red Hat JBoss BRMS 6 tomcataffected: workaround, no fix planned “Out of support scope”
-
Red Hat JBoss Web Server (JWS) 5.3fixed: vendor fix RHSA-2020:1521
-
Red Hat JBoss Web Server 3.1fixed: vendor fix RHSA-2020:0860
-
Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat7 7.0.70-38.ep7.el6, tomcat8 8.0.36-42.ep7.el6, tomcat7-lib 7.0.70-38.ep7.el6, tomcat8-lib 8.0.36-42.ep7.el6, tomcat7-jsvc 7.0.70-38.ep7.el6, tomcat8-jsvc 8.0.36-42.ep7.el6, +19 more Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat7 7.0.70-38.ep7.el7, tomcat8 8.0.36-42.ep7.el7, tomcat7-lib 7.0.70-38.ep7.el7, tomcat8-lib 8.0.36-42.ep7.el7, tomcat7-jsvc 7.0.70-38.ep7.el7, tomcat8-jsvc 8.0.36-42.ep7.el7, +19 morefixed: vendor fix RHSA-2020:0861
-
Red Hat JBoss Web Server 5.3 for RHEL 6 Server jws5-tomcat 9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-lib 9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-native 1.2.23-4.redhat_4.el6jws, jws5-tomcat-javadoc 9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-selinux 9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-webapps 9.0.30-3.redhat_4.1.el6jws, +5 more Red Hat JBoss Web Server 5.3 for RHEL 7 Server jws5-tomcat 9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-lib 9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-native 1.2.23-4.redhat_4.el7jws, jws5-tomcat-javadoc 9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-selinux 9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-webapps 9.0.30-3.redhat_4.1.el7jws, +5 more Red Hat JBoss Web Server 5.3 for RHEL 8 jws5-tomcat 9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-lib 9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-native 1.2.23-4.redhat_4.el8jws, jws5-tomcat-javadoc 9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-selinux 9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-webapps 9.0.30-3.redhat_4.1.el8jws, +5 morefixed: vendor fix RHSA-2020:1520
-
Red Hat Enterprise Linux 5 tomcat5 Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat Fuse 7 tomcat Red Hat JBoss Data Grid 7 tomcat Red Hat JBoss Fuse 6 tomcat Red Hat Software Collections rh-java-common-tomcat-lib, rh-java-common-tomcat-javadoc, rh-java-common-tomcat-el-2.2-api, rh-java-common-tomcat-jsp-2.2-api, rh-java-common-tomcat-servlet-3.0-apinot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last mo.
Exploit prediction
1.22% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.tomcat.embed:tomcat-embed-core | <7.0.99 >=8.0.0, <8.5.49 >=9.0.0, <9.0.29 |
7.0.99 8.5.49 9.0.29 |
Affected products
- Apache Software Foundation Apache Tomcat
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
oracle.com
/security-alerts/cpuapr2020.html
web, patch, third-party-advisory
-
debian.org
/security/2019/dsa-4596
vendor-advisory, web, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-01/msg00013.html
vendor-advisory, web, mailing-list, third-party-advisory
-
usn.ubuntu.com
/4251-1/
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/202003-43
vendor-advisory, web, third-party-advisory
-
debian.org
/security/2020/dsa-4680
vendor-advisory, web, third-party-advisory
-
lists.apache.org
/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E
web, mailing-list, vendor-advisory
-
seclists.org
/bugtraq/2019/Dec/43
mailing-list, web, third-party-advisory
-
security.netapp.com
/advisory/ntap-20200107-0001/
third-party-advisory
- support.f5.com /csp/article/K10107360?utm_source=f5support&%3Butm_medium=RSS
-
lists.debian.org
/debian-lts-announce/2020/01/msg00024.html
mailing-list, web, third-party-advisory
-
lists.apache.org
/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.debian.org
/debian-lts-announce/2020/03/msg00029.html
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2019-12418
advisory
-
usn.ubuntu.com
/4251-1
web
-
support.f5.com
/csp/article/K10107360?utm_source=f5support&utm_medium=RSS
web
-
security.netapp.com
/advisory/ntap-20200107-0001
web
-
lists.apache.org
/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
web
Sources
- CVE List CVE-2019-12418
- GitHub Advisory GHSA-hh3j-x4mc-g48r
- NVD CVE-2019-12418
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.