PT-2025-41925 · Apache · Apache Geode

Nbxiglk · Published 2025-10-14 · Updated 2025-10-17 · CVE-2024-44088

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.15.2

Description A malicious script injection issue exists in the Apache Geode web-api (REST). An attacker can trick a logged-in user into clicking a specially-crafted link, leading to code execution on the returned page. This could result in the theft of the user's session information and potential account takeover. The vulnerability impacts the REST API.

Recommendations Upgrade to version 1.15.2, which resolves the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-44088

GHSA-W595-4975-GM3H

Affected Products

Apache Geode

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-44088 · Security Note
• https://osv.dev/vulnerability/GHSA-w595-4975-gm3h · Vendor Advisory
• https://lists.apache.org/thread/161r34nokmcc0w74mnf04lskgb8g1d3g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-44088 · Vendor Advisory
• https://github.com/apache/geode · Note
• https://twitter.com/oss_security/status/1978982967474086031 · Twitter Post
• https://twitter.com/CVEnew/status/1978112145779786213 · Twitter Post
• http://openwall.com/lists/oss-security/2025/10/14/5 · Note
• https://t.me/cveNotify/138562 · Telegram Post