Back to CVE Browser

CVE-2017-9795

HIGH

7.5

CVSS Severity Score

EPSS Score0.1850%

EPSS Percentile13.50th

PublishedJan 10, 2018

Last ModifiedNov 21, 2024

Vulnerability Description

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code execution.

Affected Platforms (CPE)

📦

Apache

Geode

< 1.3.0

References & Advisories

🔗 http://www.securityfocus.com/bid/102488

🔗 https://lists.apache.org/thread.html/0fc5ea3c1ea06fe7058a0ab56d593914b05f728a6c93c5a6755956c7%40%3Cuser.geode.apache.org%3E

🔗 https://lists.apache.org/thread.html/232d75150991820d2fe6ba6bd4265fb58b4fe4d9d8d62eb2fd97256c%40%3Cdev.geode.apache.org%3E

🔗 https://lists.apache.org/thread.html/3a48163ca1fff757aefa4d9df24a251bb11ddd599a78cd85585abd00%40%3Cdev.geode.apache.org%3E

🔗 http://www.securityfocus.com/bid/102488

🔗 https://lists.apache.org/thread.html/0fc5ea3c1ea06fe7058a0ab56d593914b05f728a6c93c5a6755956c7%40%3Cuser.geode.apache.org%3E

🔗 https://lists.apache.org/thread.html/232d75150991820d2fe6ba6bd4265fb58b4fe4d9d8d62eb2fd97256c%40%3Cdev.geode.apache.org%3E

🔗 https://lists.apache.org/thread.html/3a48163ca1fff757aefa4d9df24a251bb11ddd599a78cd85585abd00%40%3Cdev.geode.apache.org%3E

Related Vulnerabilities

CVE-2017-156929.8

In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivile...

CVE-2016-98859.8

An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The gfsh (Geod...

CVE-2017-156958.8

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is al...

CVE-2017-56497.5

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticat...