Information Disclosure

Geode-pulse is vulnerable to information disclosure. A malicious user that does not have DATA:READ permissions on a cluster but has CLUSTER:READ permissions on a cluster can access the data browser page in Pulse, allowing them to execute an OQL query to expose sensitive data in the cluster...