VULNERABILITY INTELLIGENCE

CVE-2017-7686

CVSS score7.5 HIGH

EPSS probability2.97%

CISA KEVNot currently listed

Published2017-06-28

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.

Weakness classification

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

security@apache.org — Mitigation, Third Party Advisory
security@apache.org — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry