CVE-2017-12622

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges.

Score

CVSS 3.0 7.1 High

Status

Modified - security@apache.org

Published

2018-01-10

Last modified

2024-09-17

Weaknesses

CWE-200, CWE-284

Affected products

• Geode (Apache)
• Apache Geode (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/560578479dabbdc93d0ee8746b7c857549202ef82f43aa22496aa589%40%3Cuser.geode.apache.or…