CVE-2025-47410
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-18

Last updated on: 2025-11-04

Assigner: Apache Software Foundation

Description
Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15.1 Users are recommended to upgrade to version 1.15.2, which fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-18
Last Modified
2025-11-04
Generated
2026-06-16
AI Q&A
2025-10-18
EPSS Evaluated
2026-06-14
NVD
CVE-2025-47410
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache geode From 1.10.0 (inc) to 1.15.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Apache Geode allows Cross-Site Request Forgery (CSRF) attacks via GET requests to its Management and Monitoring REST API. An attacker who tricks a user into revealing their Geode session credentials can then submit malicious commands on the system, acting as the authenticated user.

Impact Analysis

If exploited, this vulnerability can allow attackers to execute unauthorized commands on the Apache Geode system with the privileges of an authenticated user, potentially leading to unauthorized actions, data manipulation, or system compromise.

Mitigation Strategies

Users are recommended to upgrade Apache Geode to version 1.15.2, which fixes the CSRF vulnerability. Until the upgrade can be applied, avoid exposing the Management and Monitoring REST API to untrusted networks and ensure users are aware not to share their session credentials.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-47410. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart