CVE ID:	CVE-2019-12418
Description:	When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
Test IDs:	1.3.6.1.4.1.25623.1.0.143311   1.3.6.1.4.1.25623.1.1.4.2020.1498.1   1.3.6.1.4.1.25623.1.1.4.2020.14375.1   1.3.6.1.4.1.25623.1.1.4.2020.1497.1   1.3.6.1.4.1.25623.1.0.892077   1.3.6.1.4.1.25623.1.0.892155   1.3.6.1.4.1.25623.1.0.143312
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2019-12418 Bugtraq: 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update (Google Search) https://seclists.org/bugtraq/2019/Dec/43 Debian Security Information: DSA-4596 (Google Search) https://www.debian.org/security/2019/dsa-4596 Debian Security Information: DSA-4680 (Google Search) https://www.debian.org/security/2020/dsa-4680 https://security.gentoo.org/glsa/202003-43 https://www.oracle.com/security-alerts/cpuapr2020.html https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E SuSE Security Announcement: openSUSE-SU-2020:0038 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html https://usn.ubuntu.com/4251-1/