QwikSec

Security Database

CVE

CWE

Training

CVE-2017-15695

Published: Jun 13, 2018

Modified: Sep 17, 2024

PUBLISHED

Description

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.

Vendor	Product	Versions
Apache Software Foundation	Apache Geode	affected `1.0.0 to 1.4.0`

References

[geode-user] 20180612 [SECURITY] CVE-2017-15695 Apache Geode remote code execution vulnerability

mailing-list

x_refsource_MLIST

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.