CVE-2018-1287: Missing certificate validation in Apache JMeter
Summary
CVE-2018-1287: Missing certificate validation in Apache JMeter. Affects org.apache.jmeter:ApacheJMeter versions < 4.0. Fixed in 4.0. How to fix ↓
Also tracked for
- jakarta-jmeter · Debian:11
The same CVE-2018-1287 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JMeter is a popular open-source load testing tool used for analyzing and measuring the performance of web applications. It allows users to simulate various scenarios and test the application's behavior under different loads. The tool is widely used by developers and testers to identify performance bottlenecks and optimize application performance. However, a vulnerability has been discovered in Apache JMeter versions 2.X and 3.X that affects the Distributed Test mode, where the tool binds RMI Registry to a wildcard host. This architectural assumption can be exploited by an attacker to gain unauthorized access to the JMeterEngine and execute unauthorized code. It is important to note that this vulnerability only affects those running JMeter in Distributed mode and assumes a 'safe' network environment.
Vulnerability Detail
The vulnerability in Apache JMeter allows an attacker to exploit the RMI Registry binding to a wildcard host in Distributed Test mode. By gaining access to the JMeterEngine, the attacker can execute unauthorized code, potentially leading to remote code execution and other malicious activities. This vulnerability poses a significant risk to the security and integrity of the system, as it allows unauthorized access and execution of code on the affected server. It is crucial for users of Apache JMeter in Distributed Test mode to address this vulnerability to prevent potential attacks and unauthorized access to their systems.
How To Fix
Latest published version: 5.6.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, users can mitigate the risk by not using the Distributed Test mode in Apache JMeter or by isolating the JMeter servers in a secure network environment. By limiting access to the JMeter servers and ensuring that only trusted entities have access to the network, the risk of unauthorized access and exploitation of this vulnerability can be reduced.
Conclusion
The vulnerability in Apache JMeter poses a significant risk to the security and integrity of systems running JMeter in Distributed Test mode. It is crucial for users to upgrade to the latest version of Apache JMeter and follow the recommended security practices to mitigate the risk of unauthorized access and code execution. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jmeter:ApacheJMeter →
FAQ
Apache JMeter is an open-source load testing tool used for analyzing and measuring the performance of web applications.
The vulnerability affects Apache JMeter versions 2.X and 3.X.
No, this vulnerability only affects users running JMeter in Distributed Test mode and assumes a 'safe' network environment.
The vulnerability allows unauthorized access to the JMeterEngine and execution of unauthorized code, which can lead to remote code execution and other malicious activities.
To fix this vulnerability, users should upgrade to Apache JMeter version 4.0 or later, which includes proper certificate validation in Distributed Test mode.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jmeter:ApacheJMeter.
