In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI     Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send     unauthorized code. (CVE-2018-1287)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI
    Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send
    unauthorized code. (CVE-2018-1287)

One or more versions of Apache JMeter discovered on the remote host is affected by a remote code execution vulnerability as a result of insecure RMI registry binding.

ID	Name	Product	Family	Type	Severity
256703	Linux Distros Unpatched Vulnerability : CVE-2018-1287	Nessus	Misc.	Local	critical
416211	SCA: security update for org.apache.jmeter:ApacheJMeter (GHSA-j7j7-g4ww-pxg5)	Tenable Cloud Security	SCA Checks	Local	critical
416211	SCA: security update for org.apache.jmeter:ApacheJMeter (GHSA-j7j7-g4ww-pxg5)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
106979	Apache JMeter < 4.0 Insecure RMI Registry Binding	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2018-1287

critical

Tenable Plugins

critical

critical

critical

critical