What is GHSA-p426-qw2p-v95v?

GHSA-p426-qw2p-v95v is a security advisory published by GitHub Security Advisories with Medium severity. Argument Injection in Apache Geode server

Which CVE IDs does GHSA-p426-qw2p-v95v cover?

GHSA-p426-qw2p-v95v covers the following CVE IDs: CVE-2017-15694. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p426-qw2p-v95v?

GHSA-p426-qw2p-v95v has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-p426-qw2p-v95v?

GHSA-p426-qw2p-v95v affects 1 product, including: maven/org.apache.geode:geode-core:\u003c 1.9.0.

GHSA-p426-qw2p-v95vMediumCVSS 6.5

Argument Injection in Apache Geode server

Vendor

GitHub Security Advisories

Published

June 26, 2019

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2017-15694 →

📋 Description

When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the cluster.

🎯 Affected products1

maven/org.apache.geode:geode-core:< 1.9.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2017-15694
https://lists.apache.org/thread.html/311505e7b7a045aaa246f0a1935703acacf41b954621b1363c40bf6f@%3Cuser.geode.apache.org%3E
https://github.com/advisories/GHSA-p426-qw2p-v95v