CVE-2016-9885

An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The gfsh (Geode Shell) endpoint, used by operators and application developers to connect to their cluster, is unauthenticated and publicly accessible. Because HTTPS communications are terminated at the gorouter, communications from the gorouter to GemFire clusters are unencrypted. An attacker could run any command available on gfsh and could cause denial of service, lost confidentiality of data, escalate privileges, or eavesdrop on other communications between the gorouter and the cluster.

• CWE-200
• CWE-254

• http://www.securityfocus.com/bid/95270
• https://pivotal.io/security/cve-2016-9885Vendor Advisory
• http://www.securityfocus.com/bid/95270
• https://pivotal.io/security/cve-2016-9885Vendor Advisory

Published

Jan 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9879An issue was discovered in Pivotal Spring Security before 3.…
• CVE-2016-9880The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and …
• CVE-2016-9881Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9882An issue was discovered in Cloud Foundry Foundation cf-relea…7.5
• CVE-2016-9883Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9884Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9886Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-9888An error within the "tar_directory_for_file()" function (gsf…
• CVE-2016-9889Some forms with the parameter geo_zoomlevel_to_found_locatio…
• CVE-2016-9891Cross-site scripting (XSS) vulnerability in admin/media.php …
• CVE-2016-9892The esets_daemon service in ESET Endpoint Antivirus for macO…
• CVE-2016-9893Memory safety bugs were reported in Thunderbird 45.5. Some o…