CVE-2017-9795

State: Published
Severity: Not scored
Published: Jan 10, 2018
Updated: Sep 16, 2024
Reserved: Jun 21, 2017

Description

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code execution.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Apache GeodeApache Software Foundation	1.0.0 to 1.2.1Affected

References

[user] 20180109 [SECURITY] CVE-2017-9795 Apache Geode OQL method invocation vulnerabilitymailing-list
102488vdb-entry
[geode-dev] 20190702 Re: [PROPOSAL]: Improve OQL Method Invocation Securitymailing-list
[geode-dev] 20190703 Re: [PROPOSAL]: Improve OQL Method Invocation Securitymailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.