Apache Geode OQL bind parameter vulnerability

Also known as GHSA-q7cp-r6cj-hpf5

Published 8 y ago 2018-01-10 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.3

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.5%

percentile 74%

Public exploits

none known

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions.

Exploit prediction (EPSS)

1.48% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	5.3	`CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:P/I:N/A:N`
GitHub	3.0	5.3	`CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.geode:geode-core`	>=1.0.0, <1.3.0	1.3.0

Affected products

Apache Software Foundation Apache Geode

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

lists.apache.org /thread.html/e580d22195b6b61ff9cf866ac6dd6fe16e790ff0e14a3b1a22cd20b1%40%3Cuser.geode.apac · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-9796 · advisory
issues.apache.org /jira/browse/GEODE-3248 · web
lists.apache.org /thread.html/e580d22195b6b61ff9cf866ac6dd6fe16e790ff0e14a3b1a22cd20b1@%3Cuser.geode.apache · web

Sources

CVE List: CVE-2017-9796
GitHub Advisory: GHSA-q7cp-r6cj-hpf5
NVD: CVE-2017-9796

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary