You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@geode.apache.org by William Hodges <wh...@apache.org> on 2025/10/17 16:01:45 UTC

CVE-2025-47410: Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

Severity: moderate 

Affected versions:

- Apache Geode (org.apache.geode:geode-web) 1.10.0 before 1.15.2

Description:

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user.


This issue affects Apache Geode: versions 1.10 through 1.15.1

Users are recommended to upgrade to version 1.15.2, which fixes the issue.

Credit:

S. M. Zuhair Zaki (finder)

References:

https://geode.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-47410