GitHub Advisoryadvisory · Maven

GHSA-gjp8-99fv-cgcw Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

HIGH Published 2025-10-18 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-47410
Ecosystem
Maven
Packages
org.apache.geode:geode-web
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2025-10-20

Affected packages

• Maven org.apache.geode:geode-web: >= 1.10.0, < 1.15.2 → fixed in 1.15.2

Description

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15.1 Users are recommended to upgrade to version 1.15.2, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-47410 Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References