{"id":"CVE-2026-103371","published":"2026-10-07T19:17:31.453","lastModified":"2026-10-08T17:26:22.830","description":"Insertion of Sensitive Information into Log File in Apache Geode Web Management.\n\n\n\nThis issue affects Apache Geode: from 2.0.0 before 2.0.3.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-532"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/fdkxh4z718pjp74skvgfsbhcby59lzog","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/29","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache Geode's web management interface is logging sensitive information like passwords and session tokens to log files, potentially exposing credentials and authentication data to unauthorized parties. This creates a risk of credential theft and unauthorized access to the system.","exploitability":"Exploitation requires an attacker to have access to the log files or be able to read them, which typically means they need either direct filesystem access or have already compromised a system with logging capabilities, making it moderately difficult to exploit without prior compromise.","blast_radius":"If exploited, this vulnerability could allow attackers to gain access to sensitive authentication data including passwords and session tokens from the web management interface, potentially enabling them to impersonate legitimate users or gain unauthorized administrative access.","remediation":"Upgrade to Apache Geode version 2.0.3 which fixes the log file information disclosure issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["logging","information-disclosure","web","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:03:04.368Z"}}