--- id: CVE-2019-12418 title: >- When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI reg… summary: >- When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI reg… severity: high cvss: 7 cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H' vendor: apache product: tomcat affected: - 'tomcat >= 7.0.0, <= 7.0.97' - 'tomcat >= 8.5.0, <= 8.5.47' - 'tomcat >= 9.0.0, <= 9.0.28' - debian_linux = 8.0 - debian_linux = 9.0 - debian_linux = 10.0 - workload_manager = 12.2.0.1 - workload_manager = 18c - workload_manager = 19c - ubuntu_linux = 16.04 - leap = 15.1 - 'oncommand_system_manager >= 3.0.0, <= 3.1.3' published: '2019-12-23' updated: '2026-10-08' sourceUpdated: '2026-10-08T21:17:12.080' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-12418' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html' label: security@apache.org - url: >- https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E label: security@apache.org - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html' label: security@apache.org - url: 'https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html' label: security@apache.org - url: 'https://seclists.org/bugtraq/2019/Dec/43' label: security@apache.org - url: 'https://security.gentoo.org/glsa/202003-43' label: security@apache.org - url: 'https://security.netapp.com/advisory/ntap-20200107-0001/' label: security@apache.org - url: >- https://support.f5.com/csp/article/K10107360?utm_source=f5support&%3Butm_medium=RSS label: security@apache.org - url: 'https://usn.ubuntu.com/4251-1/' label: security@apache.org - url: 'https://www.debian.org/security/2019/dsa-4596' label: security@apache.org - url: 'https://www.debian.org/security/2020/dsa-4680' label: security@apache.org - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: security@apache.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://seclists.org/bugtraq/2019/Dec/43' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202003-43' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200107-0001/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://support.f5.com/csp/article/K10107360?utm_source=f5support&%3Butm_medium=RSS label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4251-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2019/dsa-4596' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2020/dsa-4680' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.01221 epssPercentile: 0.67786 ingestedAt: '2026-10-08T22:11:53.709Z' --- ## Overview When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance. ## Affected - `tomcat >= 7.0.0, <= 7.0.97` - `tomcat >= 8.5.0, <= 8.5.47` - `tomcat >= 9.0.0, <= 9.0.28` - `debian_linux = 8.0` - `debian_linux = 9.0` - `debian_linux = 10.0` - `workload_manager = 12.2.0.1` - `workload_manager = 18c` - `workload_manager = 19c` - `ubuntu_linux = 16.04` - `leap = 15.1` - `oncommand_system_manager >= 3.0.0, <= 3.1.3` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.