Remote code execution

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote cod...

CVE-2017-9795

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote cod...

CVE-2017-12622

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges...

CVE-2017-9796

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions...

CVE-2017-9795

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote cod...

CVE-2017-12622

Summary: Apache Geode gfsh authorization vuln allows an authenticated user to read status information and control cluster members via HTTP in clusters running a Geode version before 1.3.0, even without CLUSTER:MANAGE privileges. Affected product/version: Apache Geode; versions before 1.3.0. Impac...

CVE-2017-12622

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=0.10, <=0.14), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=0.10, <=0.14) +34 more potentially affected by CVE-2017-12622 via org.apache.geode:geode-core (>=1.0.0-incubating, <=1.2.1)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =0.10, =0.10, =0.3.12, =0.3.5, =0.1.9, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =0.9.0, =2.0.0.release, =2.0.0.release, =2.0.2.release and more Source cves:...

CVE-2017-9795

CVE-2017-9795 affects Apache Geode clusters running in secure mode prior to v1.3.0. A user with read access to specific regions can execute OQL queries that read/write objects in unauthorized regions and may invoke methods enabling remote code execution. The documents do not specify exploit vecto...

CVE-2017-9795

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote cod...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=0.10, <=0.14), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=0.10, <=0.14) +34 more potentially affected by CVE-2017-9796 via org.apache.geode:geode-core (>=1.0.0-incubating, <=1.2.1)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =0.10, =0.10, =0.3.12, =0.3.5, =0.1.9, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =0.9.0, =2.0.0.release, =2.0.0.release, =2.0.2.release and more Source cves:...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=0.10, <=0.14), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=0.10, <=0.14) +34 more potentially affected by CVE-2017-9795 via org.apache.geode:geode-core (>=1.0.0-incubating, <=1.2.1)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =0.10, =0.10, =0.3.12, =0.3.5, =0.1.9, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =0.9.0, =2.0.0.release, =2.0.0.release, =2.0.2.release and more Source cves:...

CVE-2017-9796

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions...

CVE-2017-9796

CVE-2017-9796 affects Apache Geode prior to v1.3.0 when operating in secure mode. A user with read access to certain regions can have their OQL query bind parameter specify a region name, which may grant read access to objects in unauthorized regions. This is documented in multiple sources (GitHu...

PT-2018-8535

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.3.0 Description The issue allows a user with read access to specific regions within a Geode cluster to execute OQL queries, enabling read and write access to objects within unauthorized regions. Furthermore, a...

CVE-2017-12622: Exposure of Sensitive Information to an Unauthorized Actor

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges...

CVE-2017-9795: Exposure of Sensitive Information to an Unauthorized Actor

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote cod...

CVE-2017-9796: Exposure of Sensitive Information to an Unauthorized Actor

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions...

PT-2018-8536

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.3.0 Description The issue allows a user with read access to specific regions within a Geode cluster to execute OQL queries containing a region name as a bind parameter, potentially granting read access to objec...

PT-2018-5436

Name of the Vulnerable Software and Affected Versions: Apache Geode versions prior to 1.3.0 Description: The issue allows an authenticated user to obtain status information and control cluster members without the necessary CLUSTER:MANAGE privileges when connecting to an Apache Geode cluster in...