CVE-2020-1954: apache apache cxf
Vulnerability summary
CVE-2020-1954 is a medium (CVSS 5.3) vulnerability in apache apache cxf. EPSS estimates a 6.15% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 01-04-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
6.15%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 6.15% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle6 products
- communications_diameter_signaling_router≥ 8.0.0, ≤ 8.2.2
- communications_element_manager≥ 8.2.0, ≤ 8.2.2
- communications_session_report_manager≥ 8.2.0, ≤ 8.2.2
- communications_session_route_manager≥ 8.2.0, ≤ 8.2.2
- enterprise_manager_base_platform13.2.1.0
Apache2 products
- apache cxfaffects all versions prior to 3.3.6 and 3.2.13
- cxf< 3.2.13 | ≥ 3.3.0, < 3.3.6
Netapp2 products
Org.apache.cxf1 product
- cxf-rt-management< 3.2.13 | ≥ 3.3.0, < 3.3.6
4 vendors · 11 products
