CVE-2025-47410

Description

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user.This issue affects Apache Geode: versions 1.10 through 1.15.1Users are recommended to upgrade to version 1.15.2, which fixes the issue.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.015

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-47410 are fixed in Apache - geode-web 1.15.2	Windows
Vulnerabilities CVE-2025-47410 are fixed in Apache - geode-web for Linux 1.15.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234