GHSA-8P83-68CW-943F高危已审查

Apache Ignite communicates to an external PHP server where sensitive information is sent

OSV 1.4.0 · github-reviewed · 修改于 2024-11-23 02:28

发布时间

2018-10-17 04:53

GitHub 审查时间

2020-06-17 05:26

NVD 发布时间

—

源文件

advisories/github-reviewed/2018/10/GHSA-8p83-68cw-943f/GHSA-8p83-68cw-943f.json

公告说明

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.

受影响的软件包

Maven

org.apache.ignite:ignite-core

ECOSYSTEM

引入02.1

标识信息

别名 / CVE

CVE-2017-7686

CWE

CWE-200

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-8p83-68cw-943f",
  "aliases": [
    "CVE-2017-7686"
  ],
  "details": "Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.",
  "summary": "Apache Ignite communicates to an external PHP server where sensitive information is sent",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1"
            }
          ]
        }
      ],
      "package": {
        "name": "org.apache.ignite:ignite-core",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2024-11-22T18:28:37Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2018-10-16T20:53:20Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7686",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/advisories/GHSA-8p83-68cw-943f",
      "type": "ADVISORY"
    },
    {
      "url": "http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2017-7686-Apache-Ignite-Information-Disclosure-td19168.html",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-16T21:26:14Z"
  }
}