CVE-2023-37234

JMX is a mechanism for managing Java applications that enables monitoring and control of components of a running process. In Loftware Spectrum, the JMX registry is accessible without requiring authentication, which means that anyone with network access to the server can connect to this registry. An attacker can use this to perform management operations, inject code, or manipulate the running application process. The lack of access control (CWE-284) causes the application's security boundary to be effectively bypassed.

An unauthenticated remote attacker can gain full control over the Loftware Spectrum instance, potentially leading to disclosure of confidential data, modification of configuration, or execution of arbitrary code on the server (RCE).

Patches available from the vendor should be applied according to the references. As a temporary measure, it is recommended to restrict network access to JMX registry ports exclusively to trusted hosts using a firewall, and to enable authentication and SSL/TLS encryption for JMX connections.

Loftware Spectrum in versions up to and including 4.6