Vulnerability Details : CVE-2016-9885
An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The gfsh (Geode Shell) endpoint, used by operators and application developers to connect to their cluster, is unauthenticated and publicly accessible. Because HTTPS communications are terminated at the gorouter, communications from the gorouter to GemFire clusters are unencrypted. An attacker could run any command available on gfsh and could cause denial of service, lost confidentiality of data, escalate privileges, or eavesdrop on other communications between the gorouter and the cluster.
Vulnerability category: Denial of serviceInformation leak
Products affected by CVE-2016-9885
- cpe:2.3:a:pivotal_software:gemfire_for_pivotal_cloud_foundry:1.7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:gemfire_for_pivotal_cloud_foundry:1.6.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:gemfire_for_pivotal_cloud_foundry:1.6.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:gemfire_for_pivotal_cloud_foundry:1.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:gemfire_for_pivotal_cloud_foundry:1.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:gemfire_for_pivotal_cloud_foundry:1.6.0.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-9885
0.54%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 65 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-9885
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2016-9885
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-9885
-
https://pivotal.io/security/cve-2016-9885
CVE-2016-9885 gfsh exposed over go router for GemFire for PCF | Security | PivotalVendor Advisory
-
http://www.securityfocus.com/bid/95270
Pivotal GemFire for PCF CVE-2016-9885 Remote Privilege Escalation Vulnerability
Jump to