Vulnerabilities > CVE-2019-11286 - Deserialization of Untrusted Data vulnerability in VMWare Gemfire and Tanzu Gemfire FOR Virtual Machines
Attack vector
NETWORK Attack complexity
LOW Privileges required
SINGLE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against the service with a crafted set of credentials leading to remote code execution.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |