{"id":"CVE-2019-12418","state":"PUBLISHED","title":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","publishedAt":"2019-12-23T17:12:43.000Z","updatedAt":"2026-10-08T21:03:24.914Z","severity":null,"assigner":"apache","products":["Apache Software Foundation Apache Tomcat"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"version":"9.0.0.M1 to 9.0.28","status":"affected"},{"version":"8.5.0 to 8.5.47","status":"affected"},{"version":"7.0.0 to 7.0.97","status":"affected"}]}],"references":["https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E","https://www.debian.org/security/2019/dsa-4596","https://seclists.org/bugtraq/2019/Dec/43","https://security.netapp.com/advisory/ntap-20200107-0001/","https://support.f5.com/csp/article/K10107360?utm_source=f5support&amp%3Butm_medium=RSS","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html","https://usn.ubuntu.com/4251-1/","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/202003-43","https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.debian.org/security/2020/dsa-4680"],"weaknesses":[],"ingestedAt":"2026-10-29T19:45:24.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/12xxx/CVE-2019-12418.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2019-12418","state":"PUBLISHED","datePublished":"2019-12-23T17:12:43.000Z","dateUpdated":"2026-10-08T21:03:24.914Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2019-05-28T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"version":"9.0.0.M1 to 9.0.28","status":"affected"},{"version":"8.5.0 to 8.5.47","status":"affected"},{"version":"7.0.0 to 7.0.97","status":"affected"}]}],"references":[{"url":"https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_CONFIRM"]},{"url":"https://www.debian.org/security/2019/dsa-4596","name":"DSA-4596","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","name":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://security.netapp.com/advisory/ntap-20200107-0001/","tags":["x_refsource_CONFIRM"]},{"url":"https://support.f5.com/csp/article/K10107360?utm_source=f5support&amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html","name":"openSUSE-SU-2020:0038","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html","name":"[debian-lts-announce] 20200127 [SECURITY] [DLA 2077-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://usn.ubuntu.com/4251-1/","name":"USN-4251-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.gentoo.org/glsa/202003-43","name":"GLSA-202003-43","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html","name":"[debian-lts-announce] 20200324 [SECURITY] [DLA 2155-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2020/dsa-4680","name":"DSA-4680","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"problemTypes":[{"descriptions":[{"description":"Local Privilege Escalation","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"apache","dateUpdated":"2020-05-07T12:06:07.000Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@apache.org","ID":"CVE-2019-12418","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Apache Tomcat","version":{"version_data":[{"version_value":"9.0.0.M1 to 9.0.28"},{"version_value":"8.5.0 to 8.5.47"},{"version_value":"7.0.0 to 7.0.97"}]}}]},"vendor_name":"Apache Software Foundation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Local Privilege Escalation"}]}]},"references":{"reference_data":[{"name":"https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E","refsource":"CONFIRM","url":"https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E"},{"name":"DSA-4596","refsource":"DEBIAN","url":"https://www.debian.org/security/2019/dsa-4596"},{"name":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update","refsource":"BUGTRAQ","url":"https://seclists.org/bugtraq/2019/Dec/43"},{"name":"https://security.netapp.com/advisory/ntap-20200107-0001/","refsource":"CONFIRM","url":"https://security.netapp.com/advisory/ntap-20200107-0001/"},{"name":"https://support.f5.com/csp/article/K10107360?utm_source=f5support&utm_medium=RSS","refsource":"CONFIRM","url":"https://support.f5.com/csp/article/K10107360?utm_source=f5support&utm_medium=RSS"},{"name":"openSUSE-SU-2020:0038","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html"},{"name":"[debian-lts-announce] 20200127 [SECURITY] [DLA 2077-1] tomcat7 security update","refsource":"MLIST","url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html"},{"name":"USN-4251-1","refsource":"UBUNTU","url":"https://usn.ubuntu.com/4251-1/"},{"name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","refsource":"MLIST","url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E"},{"name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E"},{"name":"GLSA-202003-43","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/202003-43"},{"name":"[debian-lts-announce] 20200324 [SECURITY] [DLA 2155-1] tomcat8 security update","refsource":"MLIST","url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html"},{"name":"https://www.oracle.com/security-alerts/cpuapr2020.html","refsource":"MISC","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"name":"DSA-4680","refsource":"DEBIAN","url":"https://www.debian.org/security/2020/dsa-4680"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.debian.org/security/2019/dsa-4596","name":"DSA-4596","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","name":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20200107-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://support.f5.com/csp/article/K10107360?utm_source=f5support&amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html","name":"openSUSE-SU-2020:0038","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html","name":"[debian-lts-announce] 20200127 [SECURITY] [DLA 2077-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://usn.ubuntu.com/4251-1/","name":"USN-4251-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202003-43","name":"GLSA-202003-43","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html","name":"[debian-lts-announce] 20200324 [SECURITY] [DLA 2155-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2020/dsa-4680","name":"DSA-4680","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T23:17:40.118Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2019-12418","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T20:59:31.578877Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-08T21:03:24.914Z"}}]}}}