-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.geode:geode-core | maven | >= 1.0.0, < 1.5.0 | 1.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from internal functions not enforcing DATA:MANAGE/DATA:READ permissions properly. The commit patched authorization by 1) Adding InternalEntity marker interface to internal functions, 2) Implementing getRequiredPermissions() to specify required privileges, and 3) Modifying test cases to verify security checks. The CreateRegionFunction was particularly critical as region creation (code deployment vector) required elevating from DATA:WRITE to DATA:MANAGE privilege checks. The touch functions showed authorization scope tightening from generic to specific region permissions.