CVE-2020-11969: Missing Authentication for Critical Function in Apache TomEE
Summary
CVE-2020-11969: Missing Authentication for Critical Function in Apache TomEE. Affects org.apache.tomee:tomee across 4 version ranges.
>= 1.0.0, < 1.7.6
>= 7.0.0-M1, < 7.0.8
>= 7.1.0, < 7.1.3
>= 8.0.0-M1, < 8.0.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache TomEE is an open-source Java EE application server that combines the functionality of Apache Tomcat and Java Enterprise Edition. It provides a lightweight and easy-to-use platform for deploying and running Java web applications. The embedded ActiveMQ broker in Apache TomEE allows for messaging capabilities within the server. However, if the broker URI includes the useJMX=true parameter, it opens a JMX port on TCP port 1099 without authentication. This vulnerability affects multiple versions of Apache TomEE, including 8.0.0-M1 - 8.0.1, 7.1.0 - 7.1.2, 7.0.0-M1 - 7.0.7, and 1.0.0 - 1.7.5.
Vulnerability Detail
The vulnerability arises when Apache TomEE is configured to use the embedded ActiveMQ broker with the useJMX=true parameter. This opens an unauthenticated JMX port on TCP port 1099, allowing unauthorized access to critical functions. An attacker can exploit this vulnerability to perform various malicious actions, such as executing arbitrary code, accessing sensitive information, or disrupting the server's operation. The severity of this vulnerability is rated as HIGH with a CVSS score of 9.8.
How To Fix
Latest published version: 11.0.0-M1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.7.61.7.6 -
>= 7.0.0-M1, < 7.0.87.0.8 -
>= 7.1.0, < 7.1.37.1.3 -
>= 8.0.0-M1, < 8.0.28.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the useJMX parameter in the broker URI configuration. This can be done by removing the useJMX=true parameter from the configuration. However, this workaround may limit or disable certain JMX-related functionalities.
Conclusion
The vulnerability in Apache TomEE allows for unauthorized access to critical functions through an unauthenticated JMX port. It is crucial to upgrade to the fixed versions mentioned in the 'how_to_fix' section to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomee:tomee →
FAQ
Apache TomEE is an open-source Java EE application server that combines the functionality of Apache Tomcat and Java Enterprise Edition. It provides a lightweight and easy-to-use platform for deploying and running Java web applications.
The embedded ActiveMQ broker in Apache TomEE allows for messaging capabilities within the server. It enables applications to send and receive messages using the Java Message Service (JMS) API.
The vulnerability allows unauthorized access to critical functions by opening an unauthenticated JMX port on TCP port 1099. This can lead to various security risks, such as executing arbitrary code, accessing sensitive information, or disrupting the server's operation.
The severity of this vulnerability is rated as HIGH with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache TomEE. Please refer to the 'how_to_fix' section for specific version upgrades.
