CVE-2020-11969
Missing Authentication for Critical Function in Apache TomEE
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
- Record
CVE-2020-11969- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
- Record
CVE-2020-11969- Updated
- 2026-11-02
EUVDEUVD-2022-0901 No score
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
- Record
EUVD-2022-0901- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-836g-5fr5-fgcr
Missing Authentication for Critical Function in Apache TomEE
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
- Record
GHSA-836g-5fr5-fgcr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
OSV
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
- Record
CVE-2020-11969- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-836g-5fr5-fgcr
Missing Authentication for Critical Function in Apache TomEE
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
- Record
GHSA-836g-5fr5-fgcr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomee:tomeeMaven |
8.0.0-M1 to 8.0.1 | 8.0.2 |
org.apache.tomee:tomeeMaven |
7.1.0 to 7.1.2 | 7.1.3 |
org.apache.tomee:tomeeMaven |
7.0.0-M1 to 7.0.7 | 7.0.8 |
org.apache.tomee:tomeeMaven |
1.0.0 to 1.7.5 | 1.7.6 |
org.apache.tomee:tomeeMaven |
8.0.0-M1 up to 8.0.2, plus listed versions 8.0.08.0.0-M28.0.0-M38.0.1 |
8.0.2 |
org.apache.tomee:tomeeMaven |
7.1.0 up to 7.1.3, plus listed versions 7.1.17.1.2 |
7.1.3 |
org.apache.tomee:tomeeMaven |
7.0.0-M1 up to 7.0.8, plus listed versions 7.0.07.0.0-M27.0.0-M37.0.17.0.2 Show 5 moreShow less7.0.37.0.47.0.57.0.67.0.7 |
7.0.8 |
org.apache.tomee:tomeeMaven |
1.0.0 up to 1.7.6 | 1.7.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11969 is a critical vulnerability (CVSS 9.8) in Apache Tomee, published June 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.22%, the 91st percentile. Fixed in org.apache.tomee:tomee 8.0.2.
References
lists.apache.org/thread.html/rbd23418646dedda70a546331ea1c1d115b8975b7e7dc452d10e2e773%40%3Cdev.tomee.apache.org%3E
openwall.com/lists/oss-security/2020/12/16/2
Show 6 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-11969
github.com/advisories/GHSA-836g-5fr5-fgcr