Geode@* Security Vulnerabilities and Issues — Geode@* CVE List

Lucene search

ApacheGeode*

7 matches found

CVE•added 2018/02/27 3:29 p.m.•102 views

CVE-2017-15693

In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are presen...

7.5CVSS7.8AI score0.017EPSS

CVE•added 2018/01/10 3:29 a.m.•81 views

CVE-2017-9795

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code ...

7.5CVSS7.7AI score0.02767EPSS

CVE•added 2018/02/27 3:29 p.m.•67 views

CVE-2017-15692

In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classes are present on the classpath.

9.8CVSS9.6AI score0.04594EPSS

CVE•added 2018/06/13 5:29 p.m.•63 views

CVE-2017-15695

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.

8.8CVSS8.9AI score0.01597EPSS

CVE•added 2018/01/10 3:29 a.m.•62 views

CVE-2017-12622

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges.

7.1CVSS6.6AI score0.00113EPSS

CVE•added 2018/02/26 2:29 a.m.•60 views

CVE-2017-15696

When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.

7.5CVSS7.4AI score0.00641EPSS

CVE•added 2018/01/10 3:29 a.m.•51 views

CVE-2017-9796

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions.

5.3CVSS5.1AI score0.00163EPSS