Servers and applications

CVE-2019-2684

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can…

Severity: Medium 5.9
Published: 23 Apr 2019
Last changed: 17 Jun 2026
Added to UpHeron: 21 Oct 2026
Sources: NVD

Affected software

Software	Affected versions
Apache TomcatServers and applications · `cpe:a:apache:tomcat`	From 9.0.1 up to 9.0.28 Version 9.0.0-milestone27 Version 9.0.0-milestone26 Version 9.0.0-milestone25 All 30 release lines From 7.0.0 up to 7.0.97 From 8.5.0 up to 8.5.47 Version 9.0.0-milestone1 Version 9.0.0-milestone2 Version 9.0.0-milestone3 Version 9.0.0-milestone4 Version 9.0.0-milestone5 Version 9.0.0-milestone6 Version 9.0.0-milestone7 Version 9.0.0-milestone8 Version 9.0.0-milestone9 Version 9.0.0-milestone10 Version 9.0.0-milestone11 Version 9.0.0-milestone12 Version 9.0.0-milestone13 Version 9.0.0-milestone14 Version 9.0.0-milestone15 Version 9.0.0-milestone16 Version 9.0.0-milestone17 Version 9.0.0-milestone18 Version 9.0.0-milestone19 Version 9.0.0-milestone20 Version 9.0.0-milestone21 Version 9.0.0-milestone22 Version 9.0.0-milestone23 Version 9.0.0-milestone24 Version 9.0.0-milestone25 Version 9.0.0-milestone26 Version 9.0.0-milestone27 From 9.0.1 up to 9.0.28
JavaServers and applications · `cpe:a:oracle:jdk`	Version 1.7.0-update211 Version 1.8.0-update201 Version 1.8.0-update202 Version 11.0.2 Version 12
JavaServers and applications · `cpe:a:oracle:jre`	Version 1.7.0-update211 Version 1.8.0-update201 Version 1.8.0-update202 Version 11.0.2 Version 12

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2019-2684
CVE.org https://www.cve.org/CVERecord?id=CVE-2019-2684