Spring Data Geode Insecure Temporary Directory Vulnerability Allowing Cache Data Exposure

A vulnerability in Spring Data Geode allows for the extraction of snapshot archives into predictable and permissive directories within the system's temporary location. This issue is present in Spring Data Geode versions 2.0.0 prior to 2.7.18 and versions 1.7.0 through 2.2.13. On shared hosting environments, a local user with basic privileges could access another user's extracted snapshot contents, leading to unintended exposure of cache data.

Impact

Exploitation of this vulnerability could result in unauthorized access to another user's cache data on shared hosts.

Remediation

Users can upgrade to the Never-Ending Support (NES) version for Spring, available through HeroDevs, to address this vulnerability.