CVE-2017-15695
HIGHApache Geode 1.0.0-1.4.0 - Remote Code Execution via Internal Function Invocation
Title source: llmDescription
When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.
References (2)
Core 2
Core References
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/dc8875c0b924885a884eba6d5bd7dc3f123411b2d33cffd00e351c99%40%3Cuser.geode.apache.org%3E
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/104465
Scores
CVSS v3
8.8
EPSS
0.0224
EPSS Percentile
84.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-863
Status
published
Products (2)
apache/geode
1.0.0 - 1.4.0
org.apache.geode/geode-core
1.0.0 - 1.5.0Maven
Published
Jun 13, 2018
Tracked Since
Feb 18, 2026