CVE-2020-5396CWE-284

JMX Insecure Default Configuration in GemFire

published July 31, 2020

CVSS
—
EPSS
2%
Percentile
79.4
In the wild
Unconfirmed
What it is

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01891 · 79.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2020-07-31T19:40Z
EPSS history
Timeline
  • 31 JUL 19:40Z
    JMX Insecure Default Configuration in GemFire
    cvelistv5