CVE-2017-15692: apache software foundation apache geode Deserialization of Untrusted Data
CVSS: 9.8v3.0CriticalModified
AliasesGHSA-w395-hpq9-7xwr
Published 27-02-2018Last modified 17-09-2024
Vulnerability summary
CVE-2017-15692 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in apache software foundation apache geode. EPSS estimates a 4.78% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.0 (NVD)EPSS score
4.78%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 27-02-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classes are present on the classpath.
CVSS metrics
3 scores · 2 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
4.78%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.78% on 18-09-2026
18-09-202618-10-2026
EPSS score4.78%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- geode< 1.4.0
Apache software foundation1 product
- apache geode1.0.0 to 1.3.0
Org.apache.geode1 product
- geode-core≥ 1.0.0, < 1.4.0
3 vendors · 3 products
