CVE-2017-15693

published 2018-02-27

CVE-2017-15693: In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these…

high 7.5 CVSS 3.0

AV N AC H PR L UI N S U C H I H A H

In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	geode	< 1.4.0	1.4.0
apache_software_foundation	apache_geode	—	—

CWE-502