CVEvulnerability

CVE-2025-47410

8.8 HIGH Published 2025-10-18 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2025-10-18
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352

Description

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15.1 Users are recommended to upgrade to version 1.15.2, which fixes the issue.

Affected configurations

• apache geode (>= 1.10.0 < 1.15.2)

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References