CVE-2017-15695: Apache Geode Incorrect Authorization
Summary
CVE-2017-15695: Apache Geode vulnerable to Incorrect Authorization. Affects org.apache.geode:geode-core versions >= 1.0.0, < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Geode is an open-source, distributed, in-memory data grid that provides high-speed data access across multiple nodes. It is commonly used for caching, data replication, and real-time analytics. The geode-core package is a key component of Apache Geode, responsible for core functionalities and security management. However, versions 1.0.0 to 1.4.0 of Apache Geode's geode-core package are vulnerable to an Incorrect Authorization issue.
Vulnerability Detail
The vulnerability arises when an Apache Geode server with a security manager is configured. In this scenario, a user with DATA:WRITE privileges can exploit an internal Geode function to deploy code remotely. This allows for unauthorized code execution, potentially leading to various security risks. Code deployment should be restricted to users with DATA:MANAGE privilege to mitigate this vulnerability.
How To Fix
Latest published version: 2.0.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the security manager feature in Apache Geode. This can be achieved by modifying the configuration settings to remove the security manager configuration. However, this workaround should only be considered as a temporary solution until the system can be upgraded to a patched version.
Conclusion
Apache Geode versions 1.0.0 to 1.4.0 are vulnerable to an Incorrect Authorization issue, allowing unauthorized code execution. To mitigate this vulnerability, it is crucial to upgrade to Apache Geode version 1.5.0 or later. Administrators can also temporarily disable the security manager feature as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.geode:geode-core →
FAQ
Apache Geode is an open-source, distributed, in-memory data grid that provides high-speed data access across multiple nodes. It is commonly used for caching, data replication, and real-time analytics.
Versions 1.0.0 to 1.4.0 of Apache Geode's geode-core package are affected by this vulnerability.
A user with DATA:WRITE privileges can exploit this vulnerability. Code deployment should be restricted to users with DATA:MANAGE privilege to mitigate the risk.
The vulnerability allows for unauthorized code execution, which can lead to various security risks such as data breaches, privilege escalation, and remote code execution.
To fix this vulnerability, it is recommended to upgrade to Apache Geode version 1.5.0 or later. This version includes the necessary fixes to prevent unauthorized code deployment.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.geode:geode-core.
