CVE-2025-47410: Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

[William Hodges <whodges () apache org>]

Severity: moderate 

Affected versions:

- Apache Geode (org.apache.geode:geode-web) 1.10.0 before 1.15.2

Description:

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could 
allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on 
the target system on behalf of the authenticated user.


This issue affects Apache Geode: versions 1.10 through 1.15.1

Users are recommended to upgrade to version 1.15.2, which fixes the issue.

Credit:

S. M. Zuhair Zaki (finder)

References:

https://geode.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-47410