Apache Geode vulnerabilities

Apache Geode before version 1.1.1, when security is enabled, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse, consequently executing an OQL query that exposes data stored in the cluster.

Apache Geode Web Management versions from 2.0.0 before 2.0.3 contain a vulnerability that inserts sensitive information into log files. Upgrade to version 2.0.3 is recommended.

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15.1.