Remote Code Execution (RCE)

geode-core is vulnerable to remote code execution RCE attacks. The vulnerability exists as a user with DATA:WRITE privileges can deploy code by invoking an internal geode function, when the geode server is configured with a security manager, causing the RCE attack...

Unsafe Deserialization

geode-core is vulnerable to unsafe deserialization. If a malicious user has DATA:WRITE access to a cluster, they may be able to trigger remote code execution RCE attacks. These attacks can occur because the server stores data in its serialized form and some cluster operations and API invocations...

Information Disclosure

geode-core is vulnerable to information disclosure. If a malicious user gains access to the Geode locator, they are able to access the configuration data and previously deployed code. This is possible because the configuration service doesn't correctly authorize configuration requests when...

Unauthorized Message Through Race Conditions

geode-core is vulnerable to unauthorized messages through race conditions. The vulnerability exists as a message can be authorized before actually receiving its security subject...

Unauthorized Access

geode-core is vulnerable to unauthorized access through gfsh authorization. The vulnerability exists as a user who is connected using the to the Geode cluster, using gfsh tool over HTTP, is able to read status information as well as control cluster members even without CLUSTER:MANAGE privileges...

Unauthorized Read And Write Access

geode-core is vulnerable to unauthorized read and write access. An OQL method invocation vulnerability exists which allows a user with read access within a Geode cluster to execute OQL queries which leads to read and write access to objects within unauthorized regions. Additionally, a user may al...

Unauthorized Read Access

geode-core is vulnerable to unauthorized read access. An OQL bind parameter vulnerability allows users to gain read access to objects contained in unauthorized regions of the Geode clusters...

Information Disclosure

geode-core is vulnerable to information disclosure. The library has a bug in the gfsh query pagination, causing gfsh queries to return sensitive information from a different user...

Privilege Escalation

geode-core is vulnerable to privilege escalation. A malicious user can write a simple function to change the securityManager's settings to gain privileges to execute arbitrary code...