{"cve":"CVE-2017-7686","nvd":{"published":"2017-06-28T13:29:00.217","modified":"2026-06-17T01:24:59.100","status":"Modified","description":"Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-200"],"references":["http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2017-7686-Apache-Ignite-Information-Disclosure-td19168.html","http://www.securityfocus.com/bid/99292","http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2017-7686-Apache-Ignite-Information-Disclosure-td19168.html","http://www.securityfocus.com/bid/99292"],"products":["apache:ignite"],"source":"nvd","synced_at":"2026-10-19T20:43:44.556243339+00:00"},"epss":{"cve":"CVE-2017-7686","score":0.0297,"percentile":0.87245,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-8p83-68cw-943f","url":"https://osv.dev/vulnerability/GHSA-8p83-68cw-943f","summary":"Apache Ignite communicates to an external PHP server where sensitive information is sent","modified":"2024-11-22T18:33:14.703572Z","packages":[{"ecosystem":"Maven","name":"org.apache.ignite:ignite-core","purl":"pkg:maven/org.apache.ignite/ignite-core","ranges":["<2.1"],"fixed":["2.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}