Apache Geode gfsh authorization vulnerability

Also known as GHSA-h22r-h77w-2g5f

Published 8 y ago 2018-01-10 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.1%

percentile 82%

Public exploits

none known

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges.

Exploit prediction (EPSS)

2.08% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.1	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N`
NVD	2.0	5.5	`AV:N/AC:L/Au:S/C:P/I:P/A:N`
GitHub	3.0	7.1	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.geode:geode-core`	>=1.0.0, <1.3.0	1.3.0

Affected products

Apache Software Foundation Apache Geode

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

lists.apache.org /thread.html/560578479dabbdc93d0ee8746b7c857549202ef82f43aa22496aa589%40%3Cuser.geode.apac · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-12622 · advisory
issues.apache.org /jira/browse/GEODE-3685 · web
lists.apache.org /thread.html/560578479dabbdc93d0ee8746b7c857549202ef82f43aa22496aa589@%3Cuser.geode.apache · web

Sources

CVE List: CVE-2017-12622
GitHub Advisory: GHSA-h22r-h77w-2g5f
NVD: CVE-2017-12622

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary