CVE-2020-13920: Improper Authentication

September 10, 2020 (updated July 21, 2021)

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the jmxrmi entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when a user connects.

References

activemq.apache.org/security-advisories.data/CVE-2020-13920-announcement.txt
nvd.nist.gov/vuln/detail/CVE-2020-13920

Code Behaviors & Features

Detect and mitigate CVE-2020-13920 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →