PT-2025-42650 · Apache · Apache Geode

Published 2025-10-17 · Updated 2025-10-28 · CVE-2025-47410

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Geode versions 1.10 through 1.15.1

Description Apache Geode is susceptible to Cross-Site Request Forgery (CSRF) attacks via GET requests to the Management and Monitoring REST API. Successful exploitation could allow an attacker to execute malicious commands on a target system, acting on behalf of an authenticated user who has been tricked into revealing their Geode session credentials. The vulnerable API allows the execution of gfsh commands.

Recommendations Upgrade to version 1.15.2 to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-47410

GHSA-GJP8-99FV-CGCW

Affected Products

Apache Geode

References · 15

• https://osv.dev/vulnerability/CVE-2025-47410 · Vendor Advisory
• https://lists.apache.org/thread/k88tv3rhl4ymsvt4h6qsv7sq10q5prrt · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gjp8-99fv-cgcw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47410 · Security Note
• https://github.com/apache/geode · Note
• https://github.com/apache/geode/commit/570990909e6fd1e491f01471ad30ee3c2dbff72c · Note
• https://reddit.com/r/VulnMatter/comments/1ocdw3y/resumen_diario_de_vulnerabilidades_21102025 · Reddit Post
• https://t.me/cveNotify/139384 · Telegram Post
• https://t.me/cveNotify/139338 · Telegram Post
• https://t.me/cveNotify/140671 · Telegram Post
• https://twitter.com/oss_security/status/1979229804953002441 · Twitter Post
• https://t.me/CVEtracker/35281 · Telegram Post
• http://openwall.com/lists/oss-security/2025/10/17/2 · Note
• https://reddit.com/r/VulnMatter/comments/1odakwu/resumen_diario_de_vulnerabilidades_22102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ocduv6/resumen_diario_de_vulnerabilidades_21102025 · Reddit Post