PT-2018-8535 · Apache · Apache Geode

Publicado

2018-01-10

·

Atualizado

2022-05-14

·

CVE-2017-9795

CVSS v3.1

7.5

Alta

VetorAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.3.0
Description The issue allows a user with read access to specific regions within a Geode cluster to execute OQL queries, enabling read and write access to objects within unauthorized regions. Furthermore, a user could invoke methods that allow remote code execution.
Recommendations For Apache Geode versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive regions and limiting the execution of OQL queries to authorized users. Restrict access to methods that could allow remote code execution to minimize the risk of exploitation.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-9795
GHSA-6M68-3W55-6MX4

Produtos afetados

Apache Geode