GHSA-95m2-p98f-24r5HighCVSS 7.5

Apache Geode unsafe deserialization of application objects

Published
May 14, 2022
Last Modified
January 29, 2023

🔗 CVE IDs covered (1)

CVE-2017-15693 →

📋 Description

In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.

🎯 Affected products1

  • maven/org.apache.geode:geode-core:>= 1.0.0, < 1.4.0

🔗 References (5)