H3-2020-0022
Insecure Java JMX Configuration
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 9.1 |
Description
The JMX endpoint is unauthenticated and provides users arbitrary access to the JMX-monitored application, as well as the ability to execute arbitrary code at the target.
Impact
Attackers can coerce the target to download malicious payloads from an attacker-controlled server. The attacker can then execute arbitrary commands on the target host and gain shell access.