CVE-2010-1454

VMware SpringSource tc Server Runtime <6.0.20.D-6.0.25.A-SR01 - RCE

Title source: llm

Description

com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password.

References (5)

[Vendor Advisory] http://secunia.com/advisories/39778

[Vendor Advisory] http://www.springsource.com/security/cve-2010-1454

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/58684

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/511307/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/40205

Scores

EPSS 0.0055

EPSS Percentile 67.6%

Classification

CWE

CWE-287

Status draft

Affected Products (7)

vmware/tc_server

Timeline

Published May 19, 2010

Tracked Since Feb 18, 2026