CVE-2017-15696: Authentication bypass

February 25, 2018 (updated March 16, 2018)

The Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.

References

issues.apache.org/jira/browse/GEODE-3962
lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f@%3Cdev.geode.apache.org%3E

Code Behaviors & Features

Detect and mitigate CVE-2017-15696 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →