CVE-2017-9796: Exposure of Sensitive Information to an Unauthorized Actor

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions...

PT-2018-8535

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.3.0 Description The issue allows a user with read access to specific regions within a Geode cluster to execute OQL queries, enabling read and write access to objects within unauthorized regions. Furthermore, a...

PT-2018-8536

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.3.0 Description The issue allows a user with read access to specific regions within a Geode cluster to execute OQL queries containing a region name as a bind parameter, potentially granting read access to objec...

Design/Logic Flaw

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the...

CVE-2017-5649

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the...

CVE-2017-5649

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the...

CVE-2017-5649

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the...

CVE-2017-5649

CVE-2017-5649 affects Apache Geode prior to 1.1.1. When a cluster has security-manager enabled, remote authenticated users with CLUSTER:READ but not DATA:READ can access the data browser page in Pulse and run an OQL query, exposing data stored in the cluster. The vulnerability is demonstrated by ...

CVE-2017-5649: Exposure of Sensitive Information to an Unauthorized Actor

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the...

PT-2017-16644

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.1.1 Description The issue allows remote authenticated users with limited permissions to access sensitive data. Specifically, users with CLUSTER:READ but not DATA:READ permission can access the data browser page...