apache jmeter vulnerabilities

Latest apache jmeter CVEs

Newest publication first

1. CVE-2019-0187 Unauthenticated Remote Code Execution in Apache JMeter

   Published 2019-03-06

   Critical·CVSS 9.8 EPSS 2.6%

   Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests run...

2. CVE-2018-1287 Missing certificate validation in Apache JMeter

   Published 2018-02-14

   Critical·CVSS 9.8 EPSS 3.4%

   In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.

3. CVE-2018-1297 Missing certificate validation in Apache JMeter

   Published 2018-02-13

   Critical·CVSS 9.8 EPSS 11.5%

   When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.