CVE-2017-5649
HighSummary
Apache Geode before version 1.1.1, when security is enabled, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse, consequently executing an OQL query that exposes data stored in the cluster.
Risk Assessment
The organization may be exposed to the disclosure of sensitive data, potentially leading to privacy breaches and information security issues.
Recommendation
It is recommended to upgrade Apache Geode to version 1.1.1 or later and review user permissions to restrict data access.
Other vulnerabilities in Apache Geode
See all- CVE-2026-103371High
Apache Geode Web Management versions from 2.0.0 before 2.0.3 contain a vulnerability that inserts sensitive information into log files. Upgrade to version 2.0.3 is recommended.
- CVE-2025-47410High
Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15.1.
Original NVD description (English source)
Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the cluster.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS