CVE-2020-24231
Critical
Description
Symmetric DS <3.12.0 uses mx4j to provide access to JMX over HTTP. mx4j, by default, has no auth and is available on all interfaces. An attacker can interact with JMX: get system info, and invoke MBean methods. It is possible to install additional MBeans from a remote host using MLet that leads to arbitrary code execution.
SeverityCritical
CVSS9.8
Exploit probability—
ProductJumpmind Symmetricds
PublishedOct 5, 2020
First seenOct 5, 2020
How to fix
Update
- jumpmind symmetricds3.12.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jumpmind symmetricds | v < 3.12.0 | 3.12.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.