Description
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
Remediation
References
http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E
https://bz.apache.org/bugzilla/show_bug.cgi?id=62039
https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E
Related Vulnerabilities
CVE-2021-22160 Vulnerability in maven package org.apache.pulsar:pulsar-broker-common
CVE-2023-32070 Vulnerability in maven package org.xwiki.rendering:xwiki-rendering-xml
CVE-2023-32981 Vulnerability in maven package org.jenkins-ci.plugins:pipeline-utility-steps
CVE-2022-45390 Vulnerability in maven package io.loader:loaderio-jenkins-plugin
CVE-2023-39685 Vulnerability in maven package org.hjson:hjson