CVE-2017-15693

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Geode	1.0.0 to 1.3.0

References

http://www.securityfocus.com/bid/103206Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/cc3ec1d06062f54fdaa0357874c1d148fc54bb955f2d2df4ca328a3d%40%3Cuser.geode.apache.org%3E
http://www.securityfocus.com/bid/103206Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/cc3ec1d06062f54fdaa0357874c1d148fc54bb955f2d2df4ca328a3d%40%3Cuser.geode.apache.org%3E

Timeline

Published: Feb 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-156946.5When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can CVE-2017-156958.8When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to d CVE-2017-156967.5When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configur CVE-2017-156979.8A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code executio CVE-2017-156985.9When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not co CVE-2017-156996.5A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote CVE-2017-15704.3IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 131852.CVE-2017-157008.8A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, th CVE-2017-157017.5In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frame CVE-2017-157029.8In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of whi CVE-2017-157035.0Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and cau CVE-2017-157055.3A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain uncl