CVE-2017-12622

HIGH

Apache Geode < 1.3.0 - Authenticated Exposure of Sensitive Information via gfsh HTTP Connection

Title source: llm

Description

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges.

References (1)

Core 1

Core References

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/560578479dabbdc93d0ee8746b7c857549202ef82f43aa22496aa589%40%3Cuser.geode.apache.org%3E

Scores

CVSS v3 7.1

EPSS 0.0008

EPSS Percentile 22.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Details

CWE

CWE-200

Status published

Products (2)

apache/geode < 1.3.0

org.apache.geode/geode-core 1.0.0 - 1.3.0Maven

Published Jan 10, 2018

Tracked Since Feb 18, 2026