CVE-2020-5396

Published: Jul 31, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.

Affected (5)

Products: Vmware: Gemfire, Tanzu Gemfire For Virtual Machines

2 products

Tanzu Gemfire For Virtual Machines

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Gemfire	From 9.7.0 to 9.7.6
Vmware Gemfire	From 9.8.0 to 9.8.7
Vmware Gemfire	From 9.9.0 to 9.9.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Vmware Tanzu Gemfire For Virtual Machines	From 1.10.0 to 1.10.2
Vmware Tanzu Gemfire For Virtual Machines	From 1.11.0 to 1.11.1

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://tanzu.vmware.com/security/cve-2020-5396

Source: security@pivotal.io

Vendor Advisory

https://tanzu.vmware.com/security/cve-2020-5396

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.