Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options).
    Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an     attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that     versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating     nodes so upgrade to JMeter 5.1 is also advised. (CVE-2019-0187)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options).
    Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an
    attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that
    versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating
    nodes so upgrade to JMeter 5.1 is also advised. (CVE-2019-0187)

One or more versions of Apache JMeter discovered on the remote host is affected by an unauthenticated remote code execution vulnerability which is possible when JMeter is used in distributed mode.

ID	Name	Product	Family	Severity
257023	Linux Distros Unpatched Vulnerability : CVE-2019-0187	Nessus	Misc.	critical
422514	SCA: security update for org.apache.jmeter:ApacheJMeter (GHSA-wg37-7mrv-cfwm)	Tenable Cloud Security	SCA Checks	critical
422514	SCA: security update for org.apache.jmeter:ApacheJMeter (GHSA-wg37-7mrv-cfwm)	Tenable Self-Hosted Container Security	SCA Checks	critical
122718	Apache JMeter < 5.1 Unauthenticated Remote Code Execution Vulnerability	Nessus	Windows	critical

Detections

Analytics

CVE-2019-0187

critical

Tenable Plugins

critical

critical

critical

critical