GitHub Advisoryadvisory · Maven

GHSA-8p83-68cw-943f Apache Ignite communicates to an external PHP server where sensitive information is sent

HIGH Published 2018-10-16 Modified 2024-11-22 Official page ↗
Aliases
CVE-2017-7686
Ecosystem
Maven
Packages
org.apache.ignite:ignite-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• Maven org.apache.ignite:ignite-core: < 2.1 → fixed in 2.1

Description

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.

Related

Alias · CVE (1)

  • CVE-2017-7686 Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References