High · 7.5 CVE-2017-5649 EUVD-2022-1987GHSA-2gw6-73wc-x88f

Apache Geode information disclosure vulnerability

Published Apr 4, 2017 · Updated Aug 5, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Geode Package: org.apache.geode:geode-core Ecosystem: Maven

Description

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the cluster.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Geode	1.1.0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.geode:geode-core	>= 1.1.0, < 1.1.1	1.1.1	GHSA-2gw6-73wc-x88f

References

97378 vdb-entry
[geode-user] 20170404 [CVE-2017-5649] Apache Geode information disclosure vulnerability mailing-list