CVE-2020-1954: Information Exposure

April 1, 2020 (updated July 21, 2021)

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the createMBServerConnectorFactory property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack.

References

nvd.nist.gov/vuln/detail/CVE-2020-1954

Detect and mitigate CVE-2020-1954 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →