Apache Geode Cluster Vulnerability Affecting Secure Mode Operations

CVE-2017-9796

Summary

In Apache Geode versions prior to v1.3.0, a security flaw exists in clusters operating in secure mode. A user granted read access to specific regions within the cluster can exploit this vulnerability by executing OQL queries that include region names as bind parameters. This allows unauthorized read access to objects contained within regions that should not be accessible to the user. This issue underscores the importance of strict access control mechanisms within secure configurations.

References