GitHub Advisoryadvisory · Maven

GHSA-g569-49wg-jx5f Apache Geode configuration request authorization vulnerability

HIGH Published 2022-05-14 Modified 2022-11-08 Official page ↗
Aliases
CVE-2017-15696
Ecosystem
Maven
Packages
org.apache.geode:geode-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-11-08

Affected packages

• Maven org.apache.geode:geode-core: >= 1.0.0, < 1.4.0 → fixed in 1.4.0

Description

When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.

Related

Alias · CVE (1)

  • CVE-2017-15696 When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References