High severity · published Feb 26, 2018
CVE-2017-15696
When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests
7.5
CVSS
2%
EPSS
No
On KEV
Description
When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geode · Apache
1.0.0 through 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15696
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15696
lists.apache.org
https://lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f%40%3Cdev.geode.apache.org%3E
More from Geode
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
7.8
CVE-2019-15752
Docker Desktop Community Edition Privilege Escalation Vulnerability
9.8
CVE-2022-37021
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8
9.8
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using…
9.8
CVE-2014-0048
An issue was found in Docker before 1.6.0