CVE-2017-9794
Last modified
CVE-2017-9794 is a vulnerability of currently unknown severity. When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing data that the user is not authorized to view.. EPSS estimates a 1.18% chance of exploitation in the next 30 days.
Description
When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing data that the user is not authorized to view.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Geode | <= 1.2.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-9794?
How severe is CVE-2017-9794?
How do I fix CVE-2017-9794?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-9788In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the v…
- CVE-2017-9789When under stress, closing many connections, the HTTP/2 hand…
- CVE-2017-9790When handling a libprocess message wrapped in an HTTP reques…
- CVE-2017-9791The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might a…9.8
- CVE-2017-9792In Apache Impala (incubating) before 2.10.0, a malicious use…
- CVE-2017-9793The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33…
- CVE-2017-9795When an Apache Geode cluster before v1.3.0 is operating in s…
- CVE-2017-9796When an Apache Geode cluster before v1.3.0 is operating in s…
- CVE-2017-9797When an Apache Geode cluster before v1.2.1 is operating in s…
- CVE-2017-9798Apache httpd allows remote attackers to read secret data fro…7.5
- CVE-2017-9799It was found that under some situations and configurations o…
- CVE-2017-9800A maliciously constructed svn+ssh:// URL would cause Subvers…
Are you affected by CVE-2017-9794?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST