CVE-2017-9795

CWE-200 — Information Exposure4 documents4 sources
Severity
7.5HIGH
EPSS
1.5%
top 18.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache GeodeApache Software Foundation Apache Geode
Timeline
PublishedJan 10
Latest updateMay 14

Description

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code execution.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/geode< 1.3.0
▶Mavenorg.apache.geode:geode-core1.0.0 — 1.3.0
▶CVEListV5apache_software_foundation/apache_geode1.0.0 to 1.2.1

🔴Vulnerability Details

3
GHSA
Apache Geode OQL method invocation vulnerability↗2022-05-14
▶
OSV
Apache Geode OQL method invocation vulnerability↗2022-05-14
▶
CVEList
CVE-2017-9795: When an Apache Geode cluster before v1↗2018-01-10
▶
CVE-2017-9795 (HIGH CVSS 7.5) | When an Apache Geode cluster before | cvebase.io