CVE-2017-5649: Apache Geode information disclosure vulnerability in org.apache.geode:geode-core
Summary
CVE-2017-5649: Apache Geode information disclosure vulnerability. Affects org.apache.geode:geode-core versions >= 1.1.0, < 1.1.1. Fixed in 1.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Geode is an open-source, distributed, in-memory data grid that provides high-performance data management and caching. It is designed to scale horizontally and handle large amounts of data. The geode-core package is a core component of Apache Geode, responsible for managing data storage and retrieval. This vulnerability affects versions prior to 1.1.1 of the geode-core package.
Vulnerability Detail
The vulnerability in Apache Geode allows remote authenticated users with CLUSTER:READ permission but not DATA:READ permission to access the data browser page in Pulse, a web-based management and monitoring tool for Apache Geode clusters. This access enables them to execute an OQL query that exposes data stored in the cluster. The vulnerability arises when a cluster has enabled security by setting the security-manager property. The impact of this vulnerability is the potential unauthorized access and exposure of sensitive data stored in the cluster.
How To Fix
Latest published version: 2.0.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a workaround is to disable the data browser page in Pulse or restrict access to it. This can be done by modifying the configuration of the Apache Geode cluster to remove or restrict the permissions of users with CLUSTER:READ permission. Additionally, it is recommended to review and adjust the security settings of the cluster to ensure proper access controls are in place.
Conclusion
The Apache Geode information disclosure vulnerability in the org.apache.geode:geode-core package allows remote authenticated users to access and expose sensitive data stored in the cluster. It is recommended to upgrade to version 1.1.1 or later of the geode-core package to fix this vulnerability. If immediate upgrade is not possible, consider implementing the provided workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.geode:geode-core →
FAQ
Apache Geode is an open-source, distributed, in-memory data grid that provides high-performance data management and caching.
The geode-core package is a core component of Apache Geode, responsible for managing data storage and retrieval.
The vulnerability allows unauthorized access to sensitive data stored in the Apache Geode cluster.
Upgrade to version 1.1.1 or later of the geode-core package.
Yes, you can disable the data browser page in Pulse or restrict access to it.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.geode:geode-core.
