Riskcovery

CVE-2020-5396

JMX Insecure Default Configuration in GemFire

State
Published
Severity
Not scored
Published
Jul 31, 2020
Updated
Sep 16, 2024
Reserved
Jan 3, 2020

Read the record on cve.org

Description

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-284 Improper Access Control - Generic

Affected Products

ProductVersions
VMware Tanzu GemFire for VMsVMware Tanzu
  • 1.10 to before 1.10.2Affected
  • 1.11 to before 1.11.1Affected
VMware GemFireVMware Tanzu
  • 9.7 to before 9.7.6Affected
  • 9.8 to before 9.8.7Affected
  • 9.9 to before 9.9.2Affected
  • 9.10 to before 9.10.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.