VulnerableCode Package Details - pkg:maven/org.apache.tomee/openejb-lite@7.0.0-M1

Search for packages

Vulnerability	Summary	Fixed by
VCID-2w4b-at7v-jfew Aliases: CVE-2021-40690 GHSA-j8wc-gxx9-82hx	All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.	8.0.8 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-2w4b-at7v-jfew
Aliases:
CVE-2021-40690
GHSA-j8wc-gxx9-82hx

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

8.0.8
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-rn5j-hjuu-vkhf	Remote code execution in Apache TomEE If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.	CVE-2020-13931 GHSA-mp28-rq7g-qx62
VCID-vxxe-ka1m-aqea	Missing Authentication for Critical Function in Apache TomEE If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.	CVE-2020-11969 GHSA-836g-5fr5-fgcr

Vulnerability

Summary

Aliases

VCID-rn5j-hjuu-vkhf

Remote code execution in Apache TomEE If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.

CVE-2020-13931
GHSA-mp28-rq7g-qx62

VCID-vxxe-ka1m-aqea

Missing Authentication for Critical Function in Apache TomEE If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.

CVE-2020-11969
GHSA-836g-5fr5-fgcr

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-08-01T11:16:09.865054+00:00	GitLab Importer	Fixing	VCID-rn5j-hjuu-vkhf	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/openejb-lite/CVE-2020-13931.yml	37.0.0
2025-08-01T11:15:01.169738+00:00	GitLab Importer	Fixing	VCID-vxxe-ka1m-aqea	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/openejb-lite/CVE-2020-11969.yml	37.0.0
2025-08-01T10:03:19.779462+00:00	GitLab Importer	Affected by	VCID-2w4b-at7v-jfew	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/openejb-lite/CVE-2021-40690.yml	37.0.0