Description
Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
VMware Spring Data Geode
Default version status: unaffected
2.0.0.RELEASE to ≤ 2.7.18affected
VMware Spring Data Gemfire
Default version status: unaffected
1.7.0.RELEASE to ≤ 2.2.13.RELEASEaffected