CVE-2019-12418: Insufficiently Protected Credentials in Apache Tomcat
Summary
CVE-2019-12418: Insufficiently Protected Credentials in Apache Tomcat. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
< 7.0.99
>= 8.0.0, < 8.5.49
>= 9.0.0, < 9.0.29
Fixed in 7.0.99, 8.5.49 or 9.0.29, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat9 · Debian:11
The same CVE-2019-12418 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for deploying Java-based web applications. It provides a robust and scalable platform for running Java web applications. The Tomcat server includes various components and features, including the JMX Remote Lifecycle Listener, which allows remote management and monitoring of the Tomcat instance via the Java Management Extensions (JMX) interface. This vulnerability affects Apache Tomcat versions 7.0.0 to 7.0.97, 8.5.0 to 8.5.47, and 9.0.0.M1 to 9.0.28.
Vulnerability Detail
The vulnerability arises when Apache Tomcat is configured with the JMX Remote Lifecycle Listener. In this configuration, a local attacker without access to the Tomcat process or configuration files can manipulate the RMI registry to perform a man-in-the-middle attack. By doing so, the attacker can intercept and capture user names and passwords used to access the JMX interface. With these credentials, the attacker can gain complete control over the Tomcat instance, potentially leading to unauthorized access, data breaches, or disruption of services.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.0.997.0.99 -
>= 8.0.0, < 8.5.498.5.49 -
>= 9.0.0, < 9.0.299.0.29
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a workaround can be implemented by disabling the JMX Remote Lifecycle Listener in the Tomcat configuration. This can be achieved by removing or commenting out the relevant configuration entries related to the JMX Remote Lifecycle Listener in the server.xml file. However, it is strongly recommended to upgrade to a fixed version as soon as possible to ensure comprehensive security.
Conclusion
The vulnerability in Apache Tomcat allows a local attacker to manipulate the RMI registry and capture user credentials used to access the JMX interface. This can lead to unauthorized access and control over the Tomcat instance. It is crucial to upgrade to a fixed version of Apache Tomcat or disable the JMX Remote Lifecycle Listener to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container used for deploying Java-based web applications.
The JMX Remote Lifecycle Listener is a component in Apache Tomcat that enables remote management and monitoring of the Tomcat instance via the JMX interface.
The vulnerability occurs when Apache Tomcat is configured with the JMX Remote Lifecycle Listener, allowing a local attacker to perform a man-in-the-middle attack and capture user credentials used to access the JMX interface.
With the captured credentials, an attacker can gain complete control over the Tomcat instance, potentially leading to unauthorized access, data breaches, or disruption of services.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat. Alternatively, you can disable the JMX Remote Lifecycle Listener in the Tomcat configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
