CVE-2019-11286

Published: Jul 31, 2020Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: NVD

Description

VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against the service with a crafted set of credentials leading to remote code execution.

Affected (6)

Products: Vmware: Gemfire, Tanzu Gemfire For Virtual Machines

Vmware

2 products

Gemfire

Tanzu Gemfire For Virtual Machines

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Gemfire	From 9.7.0 to 9.7.5
Vmware Gemfire	From 9.8.0 to 9.8.5
Vmware Gemfire	From 9.9.0 to 9.9.1

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Tanzu Gemfire For Virtual Machines	From 1.10.0 to 1.10.1
Vmware Tanzu Gemfire For Virtual Machines	From 1.8.0 to 1.8.2
Vmware Tanzu Gemfire For Virtual Machines	From 1.9.0 to 1.9.2

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://tanzu.vmware.com/security/cve-2019-11286

Source: security@pivotal.io

Vendor Advisory

https://tanzu.vmware.com/security/cve-2019-11286

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.