CVE-2018-1297
Missing certificate validation in Apache JMeter
CVE-2018-1297 is a critical vulnerability (CVSS 9.8) in Apache Jmeter, published February 13, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 11.5%, the 96th percentile. Fixed in org.apache.jmeter:ApacheJMeter 4.0.
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
- Record
CVE-2018-1297- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-319
- Updated
- 2026-11-02
CVE List No score
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
- Record
CVE-2018-1297- Updated
- 2026-11-02
EUVDEUVD-2022-3064 No score
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
- Record
EUVD-2022-3064- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7v85-6hv2-rwgw
Missing certificate validation in Apache JMeter
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
- Record
GHSA-7v85-6hv2-rwgw- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-319
- Updated
- 2026-11-02
OSV
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
- Record
CVE-2018-1297- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1297
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
- Record
DEBIAN-CVE-2018-1297- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-7v85-6hv2-rwgw
Missing certificate validation in Apache JMeter
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
- Record
GHSA-7v85-6hv2-rwgw- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-319
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1297
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
- Record
UBUNTU-CVE-2018-1297- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.jmeter:ApacheJMeterMaven |
before 4.0 | 4.0 |
jakarta-jmeterDebian:12 |
All versions, plus listed versions 2.13-52.13-6.12.13-7 |
None known |
jakarta-jmeterDebian:13 |
All versions, plus listed versions 2.13-52.13-6.12.13-7 |
None known |
jakarta-jmeterDebian:14 |
All versions, plus listed versions 2.13-52.13-6.12.13-7 |
None known |
org.apache.jmeter:ApacheJMeterMaven |
before 4.0, plus listed versions 2.102.112.122.132.6 Show 7 moreShow less2.72.82.93.03.13.23.3 |
4.0 |
jakarta-jmeterUbuntu:16.04:LTS |
All versions, plus listed versions 2.11-32.11-42.11-5 |
None known |
jakarta-jmeterUbuntu:18.04:LTS |
All versions, plus listed versions 2.13-3 |
None known |
jakarta-jmeterUbuntu:20.04:LTS |
All versions, plus listed versions 2.13-4 |
None known |
jakarta-jmeterUbuntu:22.04:LTS |
All versions, plus listed versions 2.13-42.13-5 |
None known |
jakarta-jmeterUbuntu:24.04:LTS |
All versions, plus listed versions 2.13-5 |
None known |
jakarta-jmeterUbuntu:25.10 |
All versions, plus listed versions 2.13-5 |
None known |
jakarta-jmeterUbuntu:26.10 |
All versions, plus listed versions 2.13-5build12.13-6.1 |
None known |
jakarta-jmeterUbuntu:26.04:LTS |
All versions, plus listed versions 2.13-52.13-5build1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 48484848484848/Jmeter-CVE-2018-1297- | 2023-10-30 |
| PoC in GitHub | Al1ex/CVE-2018-1297 | 2020-07-16 |
| PoC in GitHub | CyberCTF/vulhub-jmeter-cve-2018-1297 | 2026-10-08 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E
bz.apache.org/bugzilla/show_bug.cgi?id=62039
lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2018-1297
github.com/apache/jmeter/issues/4677