Information disclosure in Apache Geode
Priority MEDIUM 40CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code execution.
Why it matters now
EPSS 0.04177 90th percentileScored 2026-11-07
Fix Fixed org.apache.geode:geode-core (Maven): 1.3.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Geode | 1.0.0 to 1.2.1 | — | No fix listed | CNA |
| — | org.apache.geode:geode-core (Maven) | 1.0.0 to before 1.3.0 | 1.3.0 | Patch available | GHSA-6m68-3w55-6mx4 |
- Apache Geode VendorApache Affected 1.0.0 to 1.2.1 Fixed in — No fix listed CNA
- org.apache.geode:geode-core (Maven) Vendor— Affected 1.0.0 to before 1.3.0 Fixed in 1.3.0 Patch available GHSA-6m68-3w55-6mx4
Remediation
- Fix · GHSA-6m68-3w55-6mx4 org.apache.geode:geode-core (Maven) Fixed in 1.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-9795
- 2026-10-03 Alias added: GHSA-6m68-3w55-6mx4
References
Other 7
- [user] 20180109 [SECURITY] CVE-2017-9795 Apache Geode OQL method invocation vulnerability
- [geode-dev] 20190702 Re: [PROPOSAL]: Improve OQL Method Invocation Security
- [geode-dev] 20190703 Re: [PROPOSAL]: Improve OQL Method Invocation Security
- https://issues.apache.org/jira/browse/GEODE-3247
- https://lists.apache.org/thread.html/0fc5ea3c1ea06fe7058a0ab56d593914b05f728a6c93c5a6755956c7@%3Cuser.geode.apache.org%3E
- https://lists.apache.org/thread.html/232d75150991820d2fe6ba6bd4265fb58b4fe4d9d8d62eb2fd97256c@%3Cdev.geode.apache.org%3E
- https://lists.apache.org/thread.html/3a48163ca1fff757aefa4d9df24a251bb11ddd599a78cd85585abd00@%3Cdev.geode.apache.org%3E
More Apache Geode vulnerabilities
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
- TI-2017-11466 Deserialization of untrusted data in Apache Geode CVSS 3.0CRITICAL 9.8
- TI-2022-17225 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-9795 · CVE Program
- CVE-2017-9795 · NVD
- FIRST EPSS
- GHSA-6m68-3w55-6mx4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences