VulnerableCode Package Details - pkg:maven/org.apache.tomee/tomee@8.0.2

Search for packages

Vulnerability	Summary	Fixed by
VCID-2w4b-at7v-jfew Aliases: CVE-2021-40690 GHSA-j8wc-gxx9-82hx	All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.	8.0.8 Affected by 0 other vulnerabilities.
VCID-rn5j-hjuu-vkhf Aliases: CVE-2020-13931 GHSA-mp28-rq7g-qx62	Remote code execution in Apache TomEE If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.	8.0.4 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-2w4b-at7v-jfew
Aliases:
CVE-2021-40690
GHSA-j8wc-gxx9-82hx

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

8.0.8
Affected by 0 other vulnerabilities.

VCID-rn5j-hjuu-vkhf
Aliases:
CVE-2020-13931
GHSA-mp28-rq7g-qx62

Remote code execution in Apache TomEE If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.

8.0.4
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
VCID-vxxe-ka1m-aqea	Missing Authentication for Critical Function in Apache TomEE If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.	CVE-2020-11969 GHSA-836g-5fr5-fgcr

Vulnerability

Summary

Aliases

VCID-vxxe-ka1m-aqea

Missing Authentication for Critical Function in Apache TomEE If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.

CVE-2020-11969
GHSA-836g-5fr5-fgcr

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-08-01T10:03:19.701697+00:00	GitLab Importer	Affected by	VCID-2w4b-at7v-jfew	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee/CVE-2021-40690.yml	37.0.0
2025-08-01T09:46:29.458581+00:00	GitLab Importer	Affected by	VCID-rn5j-hjuu-vkhf	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee/CVE-2020-13931.yml	37.0.0
2025-07-31T12:31:15.978335+00:00	GHSA Importer	Fixing	VCID-vxxe-ka1m-aqea	https://github.com/advisories/GHSA-836g-5fr5-fgcr	37.0.0
2025-07-31T09:26:07.346488+00:00	GitLab Importer	Fixing	VCID-vxxe-ka1m-aqea	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee/CVE-2020-11969.yml	37.0.0
2025-07-31T09:03:14.185621+00:00	GithubOSV Importer	Fixing	VCID-vxxe-ka1m-aqea	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-836g-5fr5-fgcr/GHSA-836g-5fr5-fgcr.json	37.0.0