Описание
Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user.
This issue affects Apache Geode: versions 1.10 through 1.15.1
Users are recommended to upgrade to version 1.15.2, which fixes the issue.
Ссылки
- Mailing ListVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 1.10.0 (включая) до 1.15.2 (исключая)
cpe:2.3:a:apache:geode:*:*:*:*:*:*:*:*
EPSS
Процентиль: 4%
0.00018
Низкий
8.8 High
CVSS3
Дефекты
CWE-352
Связанные уязвимости
CVSS3: 8.8
github
4 месяца назад
Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system
EPSS
Процентиль: 4%
0.00018
Низкий
8.8 High
CVSS3
Дефекты
CWE-352