CVE-2020-5396: VMware Tanzu GemFire for VMs, заобикаляне на вход и

Описание

Оригинално описание

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.

Засегнати продукти

• VMware Tanzu VMware Tanzu GemFire for VMs: 1.10 преди 1.10.2; 1.11 преди 1.11.1
• VMware Tanzu VMware GemFire: 9.7 преди 9.7.6; 9.8 преди 9.8.7; 9.9 преди 9.9.2; 9.10 преди 9.10.0

Вид слабост

• CWE-284 Неправилен контрол на достъпа

История

Други уязвимости в VMware Tanzu VMware Tanzu GemFire for VMs

• 9.0CVE-2019-11286

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2020-5396
• https://nvd.nist.gov/vuln/detail/CVE-2020-5396
• https://tanzu.vmware.com/security/cve-2020-5396