8.8

CVE-2020-5396

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.

Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Gemfire Version >= 9.7.0 < 9.7.6
VMware ≫ Gemfire Version >= 9.8.0 < 9.8.7
VMware ≫ Gemfire Version >= 9.9.0 < 9.9.2
VMware ≫ Tanzu Gemfire For Virtual Machines Version >= 1.10.0 < 1.10.2
VMware ≫ Tanzu Gemfire For Virtual Machines Version >= 1.11.0 < 1.11.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.6% 0.809
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.