What is CVE-2017-9794?

CVE-2017-9794 is a medium-severity vulnerability in Apache Geode, classified under Information Disclosure. CVSS score: 4.3/10. Published 2017-09-30.

How severe is CVE-2017-9794?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Information disclosure in Apache Geode

CVE-2017-9794

When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing data that the user is not authorized to view.

Vulnerability class: Information Disclosure

EPSS: 0.012 (64.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Apache Geode
Apache Software Foundation Geode — versions 1.0.0, 1.1.1, 1.2.0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security@apache.org (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2017-9794?: CVE-2017-9794 is a medium-severity vulnerability in Apache Geode, classified under Information Disclosure. CVSS score: 4.3/10. Published 2017-09-30.
How severe is CVE-2017-9794?: Medium severity. CVSS v3 base score is 4.3 out of 10.