CVE-2025-47410
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15.1.
Risk Assessment
An attacker could perform unauthorized operations on the system on behalf of a logged-in user, potentially compromising data integrity.
Recommendation
Upgrade Apache Geode to version 1.15.2, which fixes this vulnerability.
Other vulnerabilities in Apache Geode
See all- CVE-2017-5649High
Apache Geode before version 1.1.1, when security is enabled, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse, consequently executing an OQL query that exposes data stored in the cluster.
- CVE-2026-103371High
Apache Geode Web Management versions from 2.0.0 before 2.0.3 contain a vulnerability that inserts sensitive information into log files. Upgrade to version 2.0.3 is recommended.
Original NVD description (English source)
Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15.1 Users are recommended to upgrade to version 1.15.2, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS