CVE-2019-11288: Pivotal Tc Runtimes

High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days.

In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prior to 8.5.47.A, and 9.x versions prior to 9.0.27.A, when a tc Runtime instance is configured with the JMX Socket Listener, a local attacker without access to the tc Runtime process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the tc Runtime instance.

Affected products

• Pivotal Tc Runtimes: from 7.0.70.b, before 7.0.99.b (fixed in 7.0.99.b); from 8.5.4.b, before 8.5.47.a (fixed in 8.5.47.a); from 9.0.6.b, before 9.0.27.a (fixed in 9.0.27.a)
• Pivotal Tc Server: from 3.0.0, before 3.2.19 (fixed in 3.2.19); from 4.0.0, before 4.0.10 (fixed in 4.0.10)

Published 2020-01-27. Last modified 2026-06-17.