Insufficiently protected credentials in Apache Tomcat
Priority LOW 35CWE-522Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 7 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-522.
Summary
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01221 68th percentileScored 2026-11-07
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 7.0.99, 8.5.49, 9.0.29Red Hat: 4 advisoriesRed Hat: 7 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 9.0.0.M1 to 9.0.28; 8.5.0 to 8.5.47; 7.0.0 to 7.0.97 | — | No fix listed | CNA |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | before 7.0.99 | 7.0.99 | Patch available | GHSA-hh3j-x4mc-g48r |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 8.0.0 to before 8.5.49 | 8.5.49 | Patch available | GHSA-hh3j-x4mc-g48r |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.0 to before 9.0.29 | 9.0.29 | Patch available | GHSA-hh3j-x4mc-g48r |
- Apache Tomcat VendorApache Affected 9.0.0.M1 to 9.0.28; 8.5.0 to 8.5.47; 7.0.0 to 7.0.97 Fixed in — No fix listed CNA
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected before 7.0.99 Fixed in 7.0.99 Patch available GHSA-hh3j-x4mc-g48r
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.0.0 to before 8.5.49 Fixed in 8.5.49 Patch available GHSA-hh3j-x4mc-g48r
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0 to before 9.0.29 Fixed in 9.0.29 Patch available GHSA-hh3j-x4mc-g48r
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 7.0.0 – 7.0.97; 8.5.0 – 8.5.47; 9.0.0 – 9.0.28 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:* | 12.2.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* | 18c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* | 19c | Vulnerable | Oracle |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* | 3.0.0 – 3.1.3 | Vulnerable | NetApp |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.0 – 7.0.97; 8.5.0 – 8.5.47; 9.0.0 – 9.0.28 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
- cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.1.3 Vulnerable ·NetApp
Remediation
- Fix · GHSA-hh3j-x4mc-g48r org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 7.0.99 Advisory →
- Fix · GHSA-hh3j-x4mc-g48r org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.49 Advisory →
- Fix · GHSA-hh3j-x4mc-g48r org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.29 Advisory →
Red Hat 4 advisories
- RHSA-2020:1520 Released 2020-04-21 · Red Hat rating ImportantRed Hat JBoss Web Server 5.3 release
- Red Hat JBoss Web Server 5.3 for RHEL 6 Server jws5-tomcat-9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el6jws +8
- Red Hat JBoss Web Server 5.3 for RHEL 7 Server jws5-tomcat-9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el7jws +8
- Red Hat JBoss Web Server 5.3 for RHEL 8 jws5-tomcat-9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el8jws +8
- RHSA-2020:1521 Released 2020-04-21 · Red Hat rating ImportantRed Hat JBoss Web Server 5.3 release
- Red Hat JBoss Web Server (JWS) 5.3
- RHSA-2020:0861 Released 2020-03-17 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1 Service Pack 8 security update
- Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat-native-1.2.23-21.redhat_21.ep7.el6, tomcat7-7.0.70-38.ep7.el6, tomcat7-admin-webapps-7.0.70-38.ep7.el6 +22
- Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native-1.2.23-21.redhat_21.ep7.el7, tomcat7-7.0.70-38.ep7.el7, tomcat7-admin-webapps-7.0.70-38.ep7.el7 +22
Show 1 more Red Hat advisories
- RHSA-2020:0860 Released 2020-03-17 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1 Service Pack 8 security update
- Red Hat JBoss Web Server 3.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache Tomcat — USN-4251-1
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2019-13106 Session fixation in Apache TomcatPriority MEDIUM 48
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Web Server (JWS) 5.3 | Fixed | RHSA-2020:1521 |
| Red Hat JBoss Web Server 3.1 | Fixed | RHSA-2020:0860 |
| Red Hat JBoss Web Server 3.1 for RHEL 6 | Fixed | RHSA-2020:0861 |
| Red Hat JBoss Web Server 3.1 for RHEL 7 | Fixed | RHSA-2020:0861 |
| Red Hat JBoss Web Server 5.3 for RHEL 6 Server | Fixed | RHSA-2020:1520 |
| Red Hat JBoss Web Server 5.3 for RHEL 7 Server | Fixed | RHSA-2020:1520 |
| Red Hat JBoss Web Server 5.3 for RHEL 8 | Fixed | RHSA-2020:1520 |
Not affected: 6 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 7
- Red Hat Fuse 7
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Fuse 6
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12418
- 2026-10-03 Alias added: GHSA-hh3j-x4mc-g48r
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 11
- https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E
- DSA-4596
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update
- https://security.netapp.com/advisory/ntap-20200107-0001/
- openSUSE-SU-2020:0038
- [debian-lts-announce] 20200127 [SECURITY] [DLA 2077-1] tomcat7 security update
- USN-4251-1
- GLSA-202003-43
- [debian-lts-announce] 20200324 [SECURITY] [DLA 2155-1] tomcat8 security update
- DSA-4680
- https://nvd.nist.gov/vuln/detail/CVE-2019-12418
Other 14
- https://support.f5.com/csp/article/K10107360?utm_source=f5support&%3Butm_medium=RSS
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/
- https://usn.ubuntu.com/4251-1
- https://support.f5.com/csp/article/K10107360?utm_source=f5support&utm_medium=RSS
- https://security.netapp.com/advisory/ntap-20200107-0001
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2019-12418 · CVE Program
- CVE-2019-12418 · NVD
- FIRST EPSS
- GHSA-hh3j-x4mc-g48r · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12418 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences