CVE-2017-5649

HIGH

Apache Geode < 1.1.1 - Authenticated Sensitive Data Exposure via Pulse Data Browser

Title source: llm

Description

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the cluster.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/97378

Various Sources mailing-list x_refsource_mlist

http://mail-archives.apache.org/mod_mbox/geode-user/201704.mbox/%3cCAEwge-E4y=EVfhwpfRwsbnBH_hBS3Q-BJS+1BX5omYGW4dnR1w%40mail.gmail.com%3e

Scores

CVSS v3 7.5

EPSS 0.0007

EPSS Percentile 22.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (3)

apache/geode < 1.1.0

Apache Software Foundation/Apache Geode 1.1.0

org.apache.geode/geode-core 1.1.0 - 1.1.1Maven

Published Apr 04, 2017

Tracked Since Feb 18, 2026