Incorrect authorization in Apache Geode
Priority MEDIUM 43CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.
Why it matters now
EPSS 0.02513 84th percentileScored 2026-11-07
Fix Fixed org.apache.geode:geode-core (Maven): 1.5.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Geode | 1.0.0 to 1.4.0 | — | No fix listed | CNA |
| — | org.apache.geode:geode-core (Maven) | 1.0.0 to before 1.5.0 | 1.5.0 | Patch available | GHSA-jmg4-x4vp-6c6x |
- Apache Geode VendorApache Affected 1.0.0 to 1.4.0 Fixed in — No fix listed CNA
- org.apache.geode:geode-core (Maven) Vendor— Affected 1.0.0 to before 1.5.0 Fixed in 1.5.0 Patch available GHSA-jmg4-x4vp-6c6x
Remediation
- Fix · GHSA-jmg4-x4vp-6c6x org.apache.geode:geode-core (Maven) Fixed in 1.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-15695
- 2026-10-03 Alias added: GHSA-jmg4-x4vp-6c6x
References
Other 13
- [geode-user] 20180612 [SECURITY] CVE-2017-15695 Apache Geode remote code execution vulnerability
- https://github.com/apache/geode/pull/1258
- https://github.com/apache/geode/commit/00be4f9774e1adf8e7ccc2664da8005fc30bb11d
- https://github.com/apache/geode/commit/49d28f93fd2ef069693ce15d124ef3a29f22fb7d
- https://github.com/apache/geode/commit/6df14c8b1e3c644f9f810149e80bba0c2f073dab
- https://github.com/apache/geode/commit/740289c61d60256c6270756bc84b9e24b76e4913
- https://github.com/apache/geode/commit/90f8f6242927c5e16da64f38bba9abf3d450a305
- https://github.com/apache/geode/commit/954ccb545d24a9c9a35cbd84023a4d7e07032de0
- https://github.com/apache/geode/commit/aa469239860778eb46e09dd7b390aee08f152480
- https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-SecurityVulnerabilities
- https://github.com/apache/geode
- https://issues.apache.org/jira/browse/GEODE-3974
- https://lists.apache.org/thread.html/dc8875c0b924885a884eba6d5bd7dc3f123411b2d33cffd00e351c99@%3Cuser.geode.apache.org%3E
More Apache Geode vulnerabilities
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
- TI-2017-11466 Deserialization of untrusted data in Apache Geode CVSS 3.0CRITICAL 9.8
- TI-2022-17225 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-15695 · CVE Program
- CVE-2017-15695 · NVD
- FIRST EPSS
- GHSA-jmg4-x4vp-6c6x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences