Description
Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VMware | Spring Data Geode | 2.0.0.RELEASE – ≤ 2.7.18 | — |
| VMware | Spring Data Gemfire | 1.7.0.RELEASE – ≤ 2.2.13.RELEASE | — |