7.5

CVE-2021-34797: apache software foundation apache geode

CVSS: 7.5v3.1HighModified
AliasesGHSA-mw25-f5r2-hpc6
Published 04-01-2022Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2021-34797 is a high (CVSS 7.5) vulnerability in apache software foundation apache geode. EPSS estimates a 2.51% chance of exploitation in the next 30 days, higher than 84.5% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
2.51%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 04-01-2022
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

Probability

2.51%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

0.00 pp

From 2.51% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apache1 product
  • geode≤ 1.12.4 | ≥ 1.13.0, ≤ 1.13.4
Apache software foundation1 product
Org.apache.geode1 product
  • geode-core< 1.12.5 | ≥ 1.13.0, < 1.13.5

3 vendors · 3 products

References

4 links