Apache Geode vulnerable to Exposure of Sensitive Information

Also known as GHSA-vh98-fqfc-4hj3

Published 9 y ago 2017-10-02 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.4%

percentile 72%

Public exploits

none known

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of service attack on the cluster.

Exploit prediction (EPSS)

1.36% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H`
NVD	2.0	5.8	`AV:N/AC:M/Au:N/C:P/I:N/A:P`
GitHub	3.0	6.5	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.geode:geode-core`	>=1.0.0, <1.2.1	1.2.1

Affected products

Apache Software Foundation Apache Geode

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

mail-archives.apache.org /mod_mbox/geode-user/201709.mbox/%3cCAEwge-Hrbb7JS8Nygrh7geyFvW4bMZ3AdCmPOzMfvbniipz0bA%40 · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-9797 · advisory
cwiki.apache.org /confluence/display/GEODE/Release+Notes#ReleaseNotes-SecurityVulnerabilities · web
issues.apache.org /jira/browse/GEODE-3249 · web
mail-archives.apache.org /mod_mbox/geode-user/201709.mbox/%3cCAEwge-Hrbb7JS8Nygrh7geyFvW4bMZ3AdCmPOzMfvbniipz0bA@ma · web

Sources

CVE List: CVE-2017-9797
GitHub Advisory: GHSA-vh98-fqfc-4hj3
NVD: CVE-2017-9797

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary