Apache Geode configuration request authorization vulnerability

Also known as GHSA-g569-49wg-jx5f

Published 8 y ago 2018-02-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.0%

percentile 81%

Public exploits

none known

When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.

Exploit prediction (EPSS)

2.00% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`
GitHub	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.geode:geode-core`	>=1.0.0, <1.4.0	1.4.0

Affected products

Apache Software Foundation Apache Geode

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

lists.apache.org /thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f%40%3Cdev.geode.apach · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-15696 · advisory
github.com /apache/geode/pull/1059 · web
github.com /apache/geode · package
issues.apache.org /jira/browse/GEODE-3962 · web
lists.apache.org /thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f@%3Cdev.geode.apache. · web

Sources

CVE List: CVE-2017-15696
GitHub Advisory: GHSA-g569-49wg-jx5f
NVD: CVE-2017-15696

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary