CVE-2017-15696
Last modified
CVE-2017-15696 is a vulnerability of currently unknown severity. When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.. EPSS estimates a 2.04% chance of exploitation in the next 30 days.
Description
When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Geode | >= 1.0.0, <= 1.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-15696?
How severe is CVE-2017-15696?
How do I fix CVE-2017-15696?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-1569IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified v…
- CVE-2017-15691In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prio…
- CVE-2017-15692In Apache Geode before v1.4.0, the TcpServer within the Geod…
- CVE-2017-15693In Apache Geode before v1.4.0, the Geode server stores appli…
- CVE-2017-15694When an Apache Geode server versions 1.0.0 to 1.8.0 is opera…
- CVE-2017-15695When an Apache Geode server versions 1.0.0 to 1.4.0 is confi…
- CVE-2017-15697A malicious X-ProxyContextPath or X-Forwarded-Context header…
- CVE-2017-15698When parsing the AIA-Extension field of a client certificate…
- CVE-2017-15699A Denial of Service vulnerability was found in Apache Qpid D…6.5
- CVE-2017-1570IBM Jazz Foundation products could allow an authenticated us…
- CVE-2017-15700A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirect…
- CVE-2017-15701In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclus…7.5
Are you affected by CVE-2017-15696?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST