Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qbWc0LXg0dnAtNmM2eM37rw

Apache Geode vulnerable to Incorrect Authorization

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.

Permalink: https://github.com/advisories/GHSA-jmg4-x4vp-6c6x
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qbWc0LXg0dnAtNmM2eM37rw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: 8 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-jmg4-x4vp-6c6x, CVE-2017-15695
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-15695
• https://lists.apache.org/thread.html/dc8875c0b924885a884eba6d5bd7dc3f123411b2d33cffd00e351c99@%3Cuser.geode.apache.org%3E
• https://github.com/apache/geode/pull/1258
• https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-SecurityVulnerabilities
• https://issues.apache.org/jira/browse/GEODE-3974
• https://github.com/advisories/GHSA-jmg4-x4vp-6c6x

Affected Packages