CVE-2017-9796

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions.

Score

CVSS 3.0 5.3 Medium

Status

Modified - security@apache.org

Published

2018-01-10

Last modified

2024-09-17

Weaknesses

CWE-200, CWE-284

Affected products

• Geode (Apache)
• Apache Geode (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/e580d22195b6b61ff9cf866ac6dd6fe16e790ff0e14a3b1a22cd20b1%40%3Cuser.geode.apache.or…