{"id":"CVE-2018-1287","details":"In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.","aliases":["GHSA-j7j7-g4ww-pxg5"],"modified":"2026-07-08T05:50:58.607766709Z","published":"2018-02-14T14:29:00.210Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"2.1"},{"last_affected":"2.1"},{"introduced":"2.3.3-rc1"},{"last_affected":"2.3.3-rc1"},{"introduced":"2.3.3-rc2"},{"last_affected":"2.3.3-rc2"},{"introduced":"2.3.4-rc1"},{"last_affected":"2.3.4-rc1"},{"introduced":"2.3.4-rc2"},{"last_affected":"2.3.4-rc2"},{"introduced":"2.3.4-rc3"},{"last_affected":"2.3.4-rc3"},{"introduced":"2.5-rc1"},{"last_affected":"2.5-rc1"},{"introduced":"2.5-rc2"},{"last_affected":"2.5-rc2"},{"introduced":"2.5-rc3"},{"last_affected":"2.5-rc3"},{"introduced":"2.5.1-rc1"},{"last_affected":"2.5.1-rc1"},{"introduced":"2.5.1-rc2"},{"last_affected":"2.5.1-rc2"},{"introduced":"2.5.1-rc3"},{"last_affected":"2.5.1-rc3"},{"introduced":"2.6-rc1"},{"last_affected":"2.6-rc1"},{"introduced":"2.6-rc2"},{"last_affected":"2.6-rc2"},{"introduced":"2.7-rc1"},{"last_affected":"2.7-rc1"},{"introduced":"2.7-rc2"},{"last_affected":"2.7-rc2"},{"introduced":"2.8-rc2"},{"last_affected":"2.8-rc2"},{"introduced":"2.9-rc1"},{"last_affected":"2.9-rc1"},{"introduced":"2.9-rc2"},{"last_affected":"2.9-rc2"},{"introduced":"2.11-rc1"},{"last_affected":"2.11-rc1"},{"introduced":"3.0-rc1"},{"last_affected":"3.0-rc1"},{"introduced":"3.0-rc2"},{"last_affected":"3.0-rc2"},{"introduced":"3.0-rc3"},{"last_affected":"3.0-rc3"},{"introduced":"3.0-rc4"},{"last_affected":"3.0-rc4"},{"introduced":"3.0-rc5"},{"last_affected":"3.0-rc5"},{"introduced":"3.1-rc1"},{"last_affected":"3.1-rc1"},{"introduced":"3.1-rc2"},{"last_affected":"3.1-rc2"},{"introduced":"3.1-rc3"},{"last_affected":"3.1-rc3"},{"introduced":"3.1-rc4"},{"last_affected":"3.1-rc4"},{"introduced":"3.2-rc1"},{"last_affected":"3.2-rc1"},{"introduced":"3.2-rc2"},{"last_affected":"3.2-rc2"},{"introduced":"3.2-rc3"},{"last_affected":"3.2-rc3"},{"introduced":"3.3-rc1"},{"last_affected":"3.3-rc1"}],"source":"CPE_STRING","vendor_product":"apache:jmeter","cpes":["cpe:2.3:a:apache:jmeter:2.11:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3.3:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3.3:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3.4:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3.4:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3.4:rc3:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.5.1:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.5.1:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.5.1:rc3:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.5:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.5:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.5:rc3:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.6:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.6:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.7:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.7:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.8:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.9:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.9:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.0:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.0:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.0:rc3:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.0:rc4:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.0:rc5:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.1:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.1:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.1:rc3:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.1:rc4:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.2:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.2:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.2:rc3:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.3:rc1:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E"},{"type":"ADVISORY","url":"http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpYsFx1%2Brwz1A%3Dmc7wAgbDHARyj1VrWNg41y9OySuL1mqw%40mail.gmail.com%3E"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/103068"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/jmeter","events":[{"introduced":"1390e907b2f1acab3d8b905e318ab5d98129e1f4"},{"last_affected":"37073e1e60c82217aa649632972f86b1ed91b72c"}],"database_specific":{"extracted_events":[{"introduced":"2.2"},{"last_affected":"2.2"},{"introduced":"2.3"},{"last_affected":"2.3"},{"introduced":"2.3.1"},{"last_affected":"2.3.1"},{"introduced":"2.3.2"},{"last_affected":"2.3.2"},{"introduced":"2.3.3"},{"last_affected":"2.3.3"},{"introduced":"2.3.4"},{"last_affected":"2.3.4"},{"introduced":"2.4"},{"last_affected":"2.4"},{"introduced":"2.5"},{"last_affected":"2.5"},{"introduced":"2.5.1"},{"last_affected":"2.5.1"},{"introduced":"2.6"},{"last_affected":"2.6"},{"introduced":"2.7"},{"last_affected":"2.7"},{"introduced":"2.7-rc3"},{"last_affected":"2.7-rc3"},{"introduced":"2.8"},{"last_affected":"2.8"},{"introduced":"2.8-rc1"},{"last_affected":"2.8-rc1"},{"introduced":"2.9"},{"last_affected":"2.9"},{"introduced":"2.9-rc3"},{"last_affected":"2.9-rc3"},{"introduced":"2.10-rc1"},{"last_affected":"2.10-rc1"},{"introduced":"2.10-rc2"},{"last_affected":"2.10-rc2"},{"introduced":"2.11"},{"last_affected":"2.11"},{"introduced":"2.11-rc2"},{"last_affected":"2.11-rc2"},{"introduced":"2.12"},{"last_affected":"2.12"},{"introduced":"2.12-rc1"},{"last_affected":"2.12-rc1"},{"introduced":"2.12-rc2"},{"last_affected":"2.12-rc2"},{"introduced":"2.13"},{"last_affected":"2.13"},{"introduced":"2.13-rc1"},{"last_affected":"2.13-rc1"},{"introduced":"2.13-rc2"},{"last_affected":"2.13-rc2"},{"introduced":"3.0"},{"last_affected":"3.0"},{"introduced":"3.1"},{"last_affected":"3.1"},{"introduced":"3.2"},{"last_affected":"3.2"},{"introduced":"3.3"},{"last_affected":"3.3"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:apache:jmeter:2.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.3.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.5:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.6:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.7:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.7:rc3:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.8:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.8:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.9:rc3:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.10:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.10:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.11:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.11:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.12:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.12:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.12:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.13:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.13:rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:2.13:rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:jmeter:3.3:*:*:*:*:*:*:*"]}}],"versions":["2.10-rc1","2.10-rc2","2.11","2.11-rc2","2.12","2.12-rc1","2.12-rc2","2.13","2.13-rc1","2.13-rc2","2.2","2.3","2.3.1","2.3.2","2.3.3","2.3.4","2.4","2.5","2.5.1","2.6","2.7","2.7-rc3","2.8","2.8-rc1","2.9","2.9-rc3","3.0","3.1","3.2","3.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1287.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}