What’s Vulnerable › Vulnerabilities

CVE-2019-11288: tcServer JMX Socket Listener Registry Rebinding Local Privilege Escalation

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-27 · updated 2026-06-17
• Weakness: CWE-269

Description

In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prior to 8.5.47.A, and 9.x versions prior to 9.0.27.A, when a tc Runtime instance is configured with the JMX Socket Listener, a local attacker without access to the tc Runtime process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the tc Runtime instance.

Affected products

• Pivotal Tc Runtimes: from 7.0.70.b before 7.0.99.b; from 8.5.4.b before 8.5.47.a; from 9.0.6.b before 9.0.27.a — fixed in 7.0.99.b, 8.5.47.a, 9.0.27.a
• Pivotal Tc Server: from 3.0.0 before 3.2.19; from 4.0.0 before 4.0.10 — fixed in 3.2.19, 4.0.10

How to fix

Upgrade to a fixed version: Pivotal Tc Runtimes 7.0.99.b, 8.5.47.a, 9.0.27.a; Pivotal Tc Server 3.2.19, 4.0.10. Check the vendor advisory for mitigations.

References

• https://pivotal.io/security/cve-2019-11288
• https://pivotal.io/security/cve-2019-11288

Get alerted when CVE-2019-11288 or the next vulnerability affects your stack