CVE-2020-1960

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-14 · updated 2026-06-17

Description

A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data.

Affected products

Apache Software Foundation Apache Flink: from 1.1.0 through 1.1.5; from 1.2.0 through 1.2.1; from 1.3.0 through 1.3.3; from 1.4.0 through 1.4.2; from 1.5.0 through 1.5.6; from 1.6.0 through 1.6.4

References

Get alerted when CVE-2020-1960 or the next vulnerability affects your stack