CVE-2017-5649: Infoleak
Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the cluster.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Geodeto a version that resolves this vulnerability.Fixed in 1.1.1 - Compensating control
Until upgraded, restrict access to the Pulse data browser page so remote authenticated users do not have the CLUSTER:READ permission required to access it and execute an OQL query that exposes cluster data.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5649?
The severity of CVE-2017-5649 is rated high with a score of 7.5.
How do I fix CVE-2017-5649?
To mitigate CVE-2017-5649, upgrade to Apache Geode version 1.1.1 or later.
Who is affected by CVE-2017-5649?
CVE-2017-5649 affects users of Apache Geode versions prior to 1.1.1 with enabled security.
What type of attack does CVE-2017-5649 facilitate?
CVE-2017-5649 can allow remote authenticated users to access restricted data through an OQL query.
What is the vulnerability type for CVE-2017-5649?
CVE-2017-5649 falls under CWE-200, which pertains to information exposure.