PT-2018-8535 · Apache · Apache Geode

Published

2018-01-10

·

Updated

2022-05-14

·

CVE-2017-9795

CVSS v3.1

7.5

High

VectorAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.3.0
Description The issue allows a user with read access to specific regions within a Geode cluster to execute OQL queries, enabling read and write access to objects within unauthorized regions. Furthermore, a user could invoke methods that allow remote code execution.
Recommendations For Apache Geode versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive regions and limiting the execution of OQL queries to authorized users. Restrict access to methods that could allow remote code execution to minimize the risk of exploitation.

Fix

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-9795
GHSA-6M68-3W55-6MX4

Affected Products

Apache Geode