CVE-2025-47410
HIGHApache Geode 1.10.0-1.15.1 - Cross-Site Request Forgery via Management and Monitoring REST API
Title source: llmDescription
Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15.1 Users are recommended to upgrade to version 1.15.2, which fixes the issue.
References (2)
Core 2
Core References
Mailing List, Vendor Advisory vendor-advisory
https://lists.apache.org/thread/k88tv3rhl4ymsvt4h6qsv7sq10q5prrt
Scores
CVSS v3
8.8
EPSS
0.0003
EPSS Percentile
7.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-352
Status
published
Products (2)
apache/geode
1.10.0 - 1.15.2
org.apache.geode/geode-web
1.10.0 - 1.15.2Maven
Published
Oct 18, 2025
Tracked Since
Feb 18, 2026