What is GHSA-2gw6-73wc-x88f?

GHSA-2gw6-73wc-x88f is a security advisory published by GitHub Security Advisories with High severity. Apache Geode information disclosure vulnerability

Which CVE IDs does GHSA-2gw6-73wc-x88f cover?

GHSA-2gw6-73wc-x88f covers the following CVE IDs: CVE-2017-5649. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2gw6-73wc-x88f?

GHSA-2gw6-73wc-x88f has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-2gw6-73wc-x88f?

GHSA-2gw6-73wc-x88f affects 1 product, including: maven/org.apache.geode:geode-core:= 1.1.0.

GHSA-2gw6-73wc-x88fHighCVSS 7.5

Apache Geode information disclosure vulnerability

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2017-5649 →

📋 Description

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the cluster.

🎯 Affected products1

maven/org.apache.geode:geode-core:= 1.1.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2017-5649
http://mail-archives.apache.org/mod_mbox/geode-user/201704.mbox/%3cCAEwge-E4y=EVfhwpfRwsbnBH_hBS3Q-BJS+1BX5omYGW4dnR1w@mail.gmail.com%3e
https://github.com/advisories/GHSA-2gw6-73wc-x88f