Good Evening Experts,
Hope you are doing good.
I got a vulnerability in my production server and needs to be resolved at the earliest please:
Server OS : Windows 2012r2
Weblogic Server: 12c R1
The vulnerability is :
"Java JMX RMI Accessible with Common Credentials (Unauthenticated check)"
Java JMX interface is accessible via following username/password pairs:
admin/password
admin/admin
admin/activemq
monitorRole/QED
controlRole/R%26D
controlrole/password
monitorrole/password
cassandra/cassandrapassword
monitorRole/tomcat
controlRole/tomcat
monitorRole/mrpasswd
controlRole/crpasswd
role1/role1passwd
ole2/role2passwd
role3/role3passwd
admin/thisIsSupposedToBeAStrongPassword!
QID Detection Logic (Authenticated):
This QID tries to log into JMX RMI server using above credentials.
Note:if remote JMX RMI sever accessible without authentication. all of above credentials will post.
Sincerely,
Manmohan Bhakuni