Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-5vbc-strc-5ue5
Summary
Missing Authentication for Critical Function
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
Aliases
0
alias CVE-2020-11969
1
alias GHSA-836g-5fr5-fgcr
Fixed_packages
0
url pkg:maven/org.apache.tomee/openejb-lite@7.0.0-M1
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.0-M1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.0-M1
1
url pkg:maven/org.apache.tomee/openejb-lite@7.1.3
purl pkg:maven/org.apache.tomee/openejb-lite@7.1.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.1.3
2
url pkg:maven/org.apache.tomee/openejb-lite@8.0.2
purl pkg:maven/org.apache.tomee/openejb-lite@8.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@8.0.2
3
url pkg:maven/org.apache.tomee/tomee@7.0.8
purl pkg:maven/org.apache.tomee/tomee@7.0.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@7.0.8
4
url pkg:maven/org.apache.tomee/tomee@7.1.3
purl pkg:maven/org.apache.tomee/tomee@7.1.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@7.1.3
5
url pkg:maven/org.apache.tomee/tomee@8.0.2
purl pkg:maven/org.apache.tomee/tomee@8.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@8.0.2
Affected_packages
0
url pkg:maven/org.apache.tomee/openejb-lite@1.0.0
purl pkg:maven/org.apache.tomee/openejb-lite@1.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5vbc-strc-5ue5
1
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@1.0.0
1
url pkg:maven/org.apache.tomee/openejb-lite@1.7.5
purl pkg:maven/org.apache.tomee/openejb-lite@1.7.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5vbc-strc-5ue5
1
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@1.7.5
2
url pkg:maven/org.apache.tomee/openejb-lite@7.0.0
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.0
3
url pkg:maven/org.apache.tomee/openejb-lite@7.0.1
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.1
4
url pkg:maven/org.apache.tomee/openejb-lite@7.0.2
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.2
5
url pkg:maven/org.apache.tomee/openejb-lite@7.0.3
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.3
6
url pkg:maven/org.apache.tomee/openejb-lite@7.0.4
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.4
7
url pkg:maven/org.apache.tomee/openejb-lite@7.0.5
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.5
8
url pkg:maven/org.apache.tomee/openejb-lite@7.0.6
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.6
9
url pkg:maven/org.apache.tomee/openejb-lite@7.0.7
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.7
10
url pkg:maven/org.apache.tomee/openejb-lite@7.0.8
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.8
11
url pkg:maven/org.apache.tomee/openejb-lite@7.0.9
purl pkg:maven/org.apache.tomee/openejb-lite@7.0.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.0.9
12
url pkg:maven/org.apache.tomee/openejb-lite@7.1.0
purl pkg:maven/org.apache.tomee/openejb-lite@7.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.1.0
13
url pkg:maven/org.apache.tomee/openejb-lite@7.1.1
purl pkg:maven/org.apache.tomee/openejb-lite@7.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.1.1
14
url pkg:maven/org.apache.tomee/openejb-lite@7.1.2
purl pkg:maven/org.apache.tomee/openejb-lite@7.1.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@7.1.2
15
url pkg:maven/org.apache.tomee/openejb-lite@8.0.0
purl pkg:maven/org.apache.tomee/openejb-lite@8.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@8.0.0
16
url pkg:maven/org.apache.tomee/openejb-lite@8.0.1
purl pkg:maven/org.apache.tomee/openejb-lite@8.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/openejb-lite@8.0.1
17
url pkg:maven/org.apache.tomee/tomee@1.0.0
purl pkg:maven/org.apache.tomee/tomee@1.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5vbc-strc-5ue5
1
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@1.0.0
18
url pkg:maven/org.apache.tomee/tomee@1.7.5
purl pkg:maven/org.apache.tomee/tomee@1.7.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5vbc-strc-5ue5
1
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@1.7.5
19
url pkg:maven/org.apache.tomee/tomee@7.0.0-M1
purl pkg:maven/org.apache.tomee/tomee@7.0.0-M1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@7.0.0-M1
20
url pkg:maven/org.apache.tomee/tomee@7.0.7
purl pkg:maven/org.apache.tomee/tomee@7.0.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@7.0.7
21
url pkg:maven/org.apache.tomee/tomee@7.1.0
purl pkg:maven/org.apache.tomee/tomee@7.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@7.1.0
22
url pkg:maven/org.apache.tomee/tomee@7.1.2
purl pkg:maven/org.apache.tomee/tomee@7.1.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@7.1.2
23
url pkg:maven/org.apache.tomee/tomee@8.0.0-M1
purl pkg:maven/org.apache.tomee/tomee@8.0.0-M1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@8.0.0-M1
24
url pkg:maven/org.apache.tomee/tomee@8.0.1
purl pkg:maven/org.apache.tomee/tomee@8.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-46y3-rx34-pyc6
1
vulnerability VCID-5vbc-strc-5ue5
2
vulnerability VCID-dr52-xewb-k7hv
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomee/tomee@8.0.1
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-11969
reference_id
reference_type
scores
0
value 0.01111
scoring_system epss
scoring_elements 0.78332
published_at 2026-05-14T12:55:00Z
1
value 0.01111
scoring_system epss
scoring_elements 0.78141
published_at 2026-04-09T12:55:00Z
2
value 0.01111
scoring_system epss
scoring_elements 0.78166
published_at 2026-04-11T12:55:00Z
3
value 0.01111
scoring_system epss
scoring_elements 0.78148
published_at 2026-04-12T12:55:00Z
4
value 0.01111
scoring_system epss
scoring_elements 0.78144
published_at 2026-04-13T12:55:00Z
5
value 0.01111
scoring_system epss
scoring_elements 0.78178
published_at 2026-04-16T12:55:00Z
6
value 0.01111
scoring_system epss
scoring_elements 0.78177
published_at 2026-04-18T12:55:00Z
7
value 0.01111
scoring_system epss
scoring_elements 0.78172
published_at 2026-04-21T12:55:00Z
8
value 0.01111
scoring_system epss
scoring_elements 0.78204
published_at 2026-04-24T12:55:00Z
9
value 0.01111
scoring_system epss
scoring_elements 0.7821
published_at 2026-04-26T12:55:00Z
10
value 0.01111
scoring_system epss
scoring_elements 0.78224
published_at 2026-04-29T12:55:00Z
11
value 0.01111
scoring_system epss
scoring_elements 0.78238
published_at 2026-05-05T12:55:00Z
12
value 0.01111
scoring_system epss
scoring_elements 0.78264
published_at 2026-05-07T12:55:00Z
13
value 0.01111
scoring_system epss
scoring_elements 0.78281
published_at 2026-05-09T12:55:00Z
14
value 0.01111
scoring_system epss
scoring_elements 0.78276
published_at 2026-05-11T12:55:00Z
15
value 0.01111
scoring_system epss
scoring_elements 0.78293
published_at 2026-05-12T12:55:00Z
16
value 0.01111
scoring_system epss
scoring_elements 0.78088
published_at 2026-04-01T12:55:00Z
17
value 0.01111
scoring_system epss
scoring_elements 0.78097
published_at 2026-04-02T12:55:00Z
18
value 0.01111
scoring_system epss
scoring_elements 0.78127
published_at 2026-04-04T12:55:00Z
19
value 0.01111
scoring_system epss
scoring_elements 0.78109
published_at 2026-04-07T12:55:00Z
20
value 0.01111
scoring_system epss
scoring_elements 0.78135
published_at 2026-04-08T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-11969
1
reference_url https://lists.apache.org/thread.html/r85b87478f8aa4751aa3a06e88622e80ffabae376ee7283e147ee56b9@%3Cdev.tomee.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r85b87478f8aa4751aa3a06e88622e80ffabae376ee7283e147ee56b9@%3Cdev.tomee.apache.org%3E
2
reference_url https://lists.apache.org/thread.html/rbd23418646dedda70a546331ea1c1d115b8975b7e7dc452d10e2e773@%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/rbd23418646dedda70a546331ea1c1d115b8975b7e7dc452d10e2e773@%3Cannounce.apache.org%3E
3
reference_url https://lists.apache.org/thread.html/rbd23418646dedda70a546331ea1c1d115b8975b7e7dc452d10e2e773%40%3Cdev.tomee.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/rbd23418646dedda70a546331ea1c1d115b8975b7e7dc452d10e2e773%40%3Cdev.tomee.apache.org%3E
4
reference_url https://lists.apache.org/thread.html/ref088c4732e1a8dd0bbbb96e13ffafcfe65f984238ffa55f438d78fe@%3Cdev.tomee.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/ref088c4732e1a8dd0bbbb96e13ffafcfe65f984238ffa55f438d78fe@%3Cdev.tomee.apache.org%3E
5
reference_url https://lists.apache.org/thread.html/ref088c4732e1a8dd0bbbb96e13ffafcfe65f984238ffa55f438d78fe@%3Cusers.tomee.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/ref088c4732e1a8dd0bbbb96e13ffafcfe65f984238ffa55f438d78fe@%3Cusers.tomee.apache.org%3E
6
reference_url http://www.openwall.com/lists/oss-security/2020/12/16/2
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2020/12/16/2
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-11969
reference_id CVE-2020-11969
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-11969
8
reference_url https://github.com/advisories/GHSA-836g-5fr5-fgcr
reference_id GHSA-836g-5fr5-fgcr
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-836g-5fr5-fgcr
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 306
name Missing Authentication for Critical Function
description The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
3
cwe_id 287
name Improper Authentication
description When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Exploits
Severity_range_score7.0 - 9.8
Exploitability0.5
Weighted_severity8.8
Risk_score4.4
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-5vbc-strc-5ue5