Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.
References
Link | Resource |
---|---|
http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2017-7686-Apache-Ignite-Information-Disclosure-td19168.html | Mitigation Third Party Advisory |
http://www.securityfocus.com/bid/99292 | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2017-06-28 13:29
Updated : 2024-02-28 16:04
NVD link : CVE-2017-7686
Mitre link : CVE-2017-7686
CVE.ORG link : CVE-2017-7686
JSON object : View
Products Affected
apache
- ignite
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor