Default configuration

2020-07-3120:15:00

PRIOn knowledge base

www.prio-n.com

8.9 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.0%

JSON

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.

CPENameOperatorVersion
gemfirege9.8.0
gemfirelt9.8.7
gemfirege9.9.0
gemfirelt9.9.2
gemfirege9.7.0
gemfirelt9.7.6
tanzu_gemfire_for_virtual_machinesge1.11.0
tanzu_gemfire_for_virtual_machineslt1.11.1
tanzu_gemfire_for_virtual_machinesge1.10.0
tanzu_gemfire_for_virtual_machineslt1.10.2

Name	Operator	Version
gemfire	ge	9.8.0
gemfire	lt	9.8.7
gemfire	ge	9.9.0
gemfire	lt	9.9.2
gemfire	ge	9.7.0
gemfire	lt	9.7.6
tanzu_gemfire_for_virtual_machines	ge	1.11.0
tanzu_gemfire_for_virtual_machines	lt	1.11.1
tanzu_gemfire_for_virtual_machines	ge	1.10.0
tanzu_gemfire_for_virtual_machines	lt	1.10.2

References

tanzu.vmware.com/security/cve-2020-5396