CVE-2017-15696

Description

When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.609

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2017-15696,CVE-2017-15692,CVE-2017-15693 are fixed in Apache-geode-core 1.4.0	Windows
Vulnerabilities CVE-2017-15696,CVE-2017-15692,CVE-2017-15693 are fixed in Apache-geode-core for Linux 1.4.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234