Description

When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.

Remediation

References

https://lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f%40%3Cdev.geode.apache.org%3E

Related Vulnerabilities

CVE-2015-3250 Vulnerability in maven package org.apache.directory.api:api-ldap-client-all

CVE-2017-2603 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2011-3375 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2017-16047 Vulnerability in npm package mysqljs

CVE-2018-1999030 Vulnerability in maven package org.jenkins-ci.plugins:maven-artifact-choicelistprovider

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N