Vulnerabilities > CVE-2017-15695 - Incorrect Authorization vulnerability in Apache Geode

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
apache
CWE-863
NVD
Published: 2018-06-13
Updated: 2024-11-21

Summary

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.

Vulnerable Configurations

Part Description Count
Application
Apache
7

Common Weakness Enumeration (CWE)

References