CVE-2017-9796

CWE-200 — Information Exposure4 documents4 sources
Severity
5.3MEDIUM
EPSS
0.1%
top 70.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache GeodeApache Software Foundation Apache Geode
Timeline
PublishedJan 10
Latest updateMay 14

Description

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/geode< 1.3.0
▶Mavenorg.apache.geode:geode-core1.0.0 — 1.3.0
▶CVEListV5apache_software_foundation/apache_geode1.0.0 to 1.2.1

🔴Vulnerability Details

3
OSV
Apache Geode OQL bind parameter vulnerability↗2022-05-14
▶
GHSA
Apache Geode OQL bind parameter vulnerability↗2022-05-14
▶
CVEList
CVE-2017-9796: When an Apache Geode cluster before v1↗2018-01-10
▶
CVE-2017-9796 (MEDIUM CVSS 5.3) | When an Apache Geode cluster before | cvebase.io