Information disclosure in Apache Geode
Priority LOW 37CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.
Why it matters now
EPSS 0.02005 80th percentileScored 2026-11-07
Fix Fixed org.apache.geode:geode-core (Maven): 1.4.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Geode | Apache Geode 1.0.0 to 1.3.0 | — | No fix listed | CNA |
| — | org.apache.geode:geode-core (Maven) | 1.0.0 to before 1.4.0 | 1.4.0 | Patch available | GHSA-g569-49wg-jx5f |
- Apache Geode VendorApache Affected Apache Geode 1.0.0 to 1.3.0 Fixed in — No fix listed CNA
- org.apache.geode:geode-core (Maven) Vendor— Affected 1.0.0 to before 1.4.0 Fixed in 1.4.0 Patch available GHSA-g569-49wg-jx5f
Remediation
- Fix · GHSA-g569-49wg-jx5f org.apache.geode:geode-core (Maven) Fixed in 1.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-15696
- 2026-10-03 Alias added: GHSA-g569-49wg-jx5f
References
Other 5
- https://lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f%40%3Cdev.geode.apache.org%3E
- https://github.com/apache/geode/pull/1059
- https://github.com/apache/geode
- https://issues.apache.org/jira/browse/GEODE-3962
- https://lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f@%3Cdev.geode.apache.org%3E
More Apache Geode vulnerabilities
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
- TI-2017-11466 Deserialization of untrusted data in Apache Geode CVSS 3.0CRITICAL 9.8
- TI-2022-17225 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-15696 · CVE Program
- CVE-2017-15696 · NVD
- FIRST EPSS
- GHSA-g569-49wg-jx5f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences