CVE-2017-15695: High severity Apache Geode vulnerability
When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-15695?
CVE-2017-15695 is a vulnerability in Apache Geode server versions 1.0.0 to 1.4.0 that allows remote code execution when a user with DATA:WRITE privileges is able to deploy code by invoking an internal Geode function.
What is the severity of CVE-2017-15695?
CVE-2017-15695 has a severity rating of 8.8 (High).
How does CVE-2017-15695 occur?
CVE-2017-15695 occurs when an Apache Geode server configured with a security manager allows a user with DATA:WRITE privileges to deploy code by invoking an internal Geode function.
How can CVE-2017-15695 be exploited?
CVE-2017-15695 can be exploited by an attacker with DATA:WRITE privileges to remotely execute code by deploying code through an internal Geode function.
How can CVE-2017-15695 be fixed?
To fix CVE-2017-15695, code deployment should be restricted to users with DATA:MANAGE privilege on Apache Geode servers.