CVE-2018-1297: apache software foundation apache jmeter
CVSS: 9.8v3.0CriticalModified
AliasesUBUNTU-CVE-2018-1297DEBIAN-CVE-2018-1297GHSA-7v85-6hv2-rwgw
Published 13-02-2018Last modified 17-09-2024
Vulnerability summary
CVE-2018-1297 is a critical (CVSS 9.8) vulnerability in apache software foundation apache jmeter. EPSS estimates a 11.36% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.0 (NVD)EPSS score
11.36%
0%100%
Medium · +1.45 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 13-02-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
11.36%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
+1.45 pp
From 9.91% on 18-09-2026
18-09-202618-10-2026
EPSS score11.36%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- jmeter2.1 | 2.2 | 2.3 | 2.3.1 | 2.3.2 | 2.3.3 | 2.3.3:rc1 | 2.3.3:rc2 | 2.3.4 | 2.3.4:rc1 | 2.3.4:rc2 | 2.3.4:rc3 | 2.4 | 2.5 | 2.5:rc1 | 2.5:rc2 | 2.5:rc3 | 2.5.1 | 2.5.1:rc1 | 2.5.1:rc2 | 2.5.1:rc3 | 2.6 | 2.6:rc1 | 2.6:rc2 | 2.7 | 2.7:rc1 | 2.7:rc2 | 2.7:rc3 | 2.8 | 2.8:rc1 | 2.8:rc2 | 2.9 | 2.9:rc1 | 2.9:rc2 | 2.9:rc3 | 2.10:rc1 | 2.10:rc2 | 2.11 | 2.11:rc1 | 2.11:rc2 | 2.12 | 2.12:rc1 | 2.12:rc2 | 2.13 | 2.13:rc1 | 2.13:rc2 | 3.0 | 3.0:rc1 | 3.0:rc2 | 3.0:rc3 | 3.0:rc4 | 3.0:rc5 | 3.1 | 3.1:rc1 | 3.1:rc2 | 3.1:rc3 | 3.1:rc4 | 3.2 | 3.2:rc1 | 3.2:rc2 | 3.2:rc3 | 3.3 | 3.3:rc1
Apache software foundation1 product
- apache jmeter≥ 2.0, < 3.0 | ≥ 3.0, < 4.0
Debian1 product
- jakarta-jmeterAll versions (No fix recorded)
Org.apache.jmeter1 product
- ApacheJMeter< 4.0
Ubuntu1 product
- jakarta-jmeterAll versions (No fix recorded)
5 vendors · 5 products
References
11 links- bz.apache.org/bugzilla/show_bug.cgi?id=62039X Refsource CONFIRMIssue TrackingVendor AdvisoryREPORTWEB
- github.com/apache/jmeterPACKAGE