GHSA-2gw6-73wc-x88f

ghsaUSosv

Apache Geode information disclosure vulnerability

view advisory published 2022-05-17Licence: CC-BY-4.0

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the cluster.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-5649US	high7.5	2.78% (86th)	—	2017-04-04
Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permi…

references

External citations — patches, advisories, analysis.

http://mail-archives.apache.org/mod_mbox/geode-user/201704.mbox/%3cCAEwge-E4y=EVfhwpfRwsbnBH_hBS3Q-BJS+1BX5omYGW4dnR1w@mail.gmail.com%3eWEB
https://nvd.nist.gov/vuln/detail/CVE-2017-5649ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan