GHSA-vh98-fqfc-4hj3MediumCVSS 6.5

Apache Geode vulnerable to Exposure of Sensitive Information

Published
May 13, 2022
Last Modified
January 29, 2023

🔗 CVE IDs covered (1)

CVE-2017-9797 →

📋 Description

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of service attack on the cluster.

🎯 Affected products1

  • maven/org.apache.geode:geode-core:>= 1.0.0, < 1.2.1

🔗 References (5)