What is GHSA-g569-49wg-jx5f?

GHSA-g569-49wg-jx5f is a security advisory published by GitHub Security Advisories with High severity. Apache Geode configuration request authorization vulnerability

Which CVE IDs does GHSA-g569-49wg-jx5f cover?

GHSA-g569-49wg-jx5f covers the following CVE IDs: CVE-2017-15696. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g569-49wg-jx5f?

GHSA-g569-49wg-jx5f has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-g569-49wg-jx5f?

GHSA-g569-49wg-jx5f affects 1 product, including: maven/org.apache.geode:geode-core:\u003e= 1.0.0, \u003c 1.4.0.

GHSA-g569-49wg-jx5fHighCVSS 7.5

Apache Geode configuration request authorization vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2017-15696 →

📋 Description

When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.

🎯 Affected products1

maven/org.apache.geode:geode-core:>= 1.0.0, < 1.4.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2017-15696
https://lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f@%3Cdev.geode.apache.org%3E
https://github.com/apache/geode/pull/1059
https://issues.apache.org/jira/browse/GEODE-3962
https://github.com/advisories/GHSA-g569-49wg-jx5f