CVE-2017-5649: Exposure of Sensitive Information to an Unauthorized Actor

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the...

PT-2017-16644

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.1.1 Description The issue allows remote authenticated users with limited permissions to access sensitive data. Specifically, users with CLUSTER:READ but not DATA:READ permission can access the data browser page...