Description (CNA)
VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| VMware Tanzu / VMware Tanzu GemFire for VMs | affected 1.10 before 1.10.2; affected 1.11 before 1.11.1 |
| VMware Tanzu / VMware GemFire | affected 9.7 before 9.7.6; affected 9.8 before 9.8.7; affected 9.9 before 9.9.2; affected 9.10 before 9.10.0 |
CWE
CWE-284
References
ADP enrichment
No English description supplied.