Remote Code Execution Vulnerability in Apache Geode Server

CVE-2017-15693

What is CVE-2017-15693?

In Apache Geode versions prior to 1.4.0, the Geode server's handling of application objects in serialized form creates a significant security risk. When certain cluster operations or API invocations occur, these serialized objects are deserialized. A malicious user with DATA:WRITE access can exploit this mechanism to execute arbitrary code on the server if the right classes exist on the classpath, potentially leading to unauthorized control over the affected system.

References