Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-1287

CVE-2018-1287:
Missing certificate validation in Apache JMeter

9.8

CVSS Score

Basic Information

CVE ID
CVE-2018-1287
GHSA ID
GHSA-j7j7-g4ww-pxg5
EPSS Score
-
CWE
CWE-347
Published
5/13/2022
Updated
2/2/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.jmeter:ApacheJMetermaven< 4.04.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key issues: 1) The RMI registry was bound to a wildcard host (0.0.0.0) instead of a specific interface, and 2) RMI communication lacked SSL/TLS enforcement with certificate validation. The first vulnerable function (RemoteJMeterEngineImpl.startServer) is responsible for initializing the insecure RMI server, while the second (ClientJMeterEngine constructor) handles insecure client connections. The patch (Bugzilla 62039) introduced SSL socket factories and hostname binding, confirming these were missing in prior versions. The CWE-347 mapping further supports the lack of cryptographic verification in these functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In *p**** JM*t*r *.X *n* *.X, w**n usin* *istri*ut** T*st only (RMI **s**), jm*t*r s*rv*r *in*s RMI R**istry to wil***r* *ost. T*is *oul* *llow *n *tt**k*r to **t ****ss to JM*t*r*n*in* *n* s*n* un*ut*oriz** *o**. T*is only *****t t*os* runnin* in *i

Reasoning

T** vuln*r**ility st*ms *rom two k*y issu*s: *) T** RMI r**istry w*s *oun* to * wil***r* *ost (*.*.*.*) inst*** o* * sp**i*i* int*r****, *n* *) RMI *ommuni**tion l**k** SSL/TLS *n*or**m*nt wit* **rti*i**t* v*li**tion. T** *irst vuln*r**l* *un*tion (R