CVE-2020-1954: 
Java vulnerability analysis and mitigation

Apache CXF has a vulnerability (CVE-2020-1954) in its JMX integration functionality. The vulnerability affects all versions of Apache CXF prior to 3.3.6 and 3.2.13. When the 'createMBServerConnectorFactory' property of the default InstrumentationManagerImpl is not disabled, the system becomes vulnerable to man-in-the-middle (MITM) attacks (Apache Advisory).

The vulnerability exists in the JMX integration mechanism where an InstrumentationManager extension is registered with the CXF bus. The security flaw is specifically tied to the 'createMBServerConnectorFactory' property of the default InstrumentationManagerImpl. The vulnerability has a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

If exploited, an attacker on the same host can connect to the registry and rebind the entry to another server, acting as a proxy to the original server. This allows the attacker to gain access to all information that is sent and received over JMX (Apache Advisory).

Users should update to Apache CXF versions 3.3.6 or 3.2.13. Alternatively, they can set the createMBServerConnectorFactory property to false and use the default JVM JMX remote capabilities instead. From CXF 3.4.0, the createMBServerConnectorFactory property will be removed altogether (Apache Advisory).