CVE-2024-44088

published 2025-10-14

CVE-2024-44088: Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in…

medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information and even account takeover.

This issue affects Apache Geode: all versions prior to 1.15.2

Users are recommended to upgrade to version 1.15.2, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	geode	>= 1.1.0 < 1.15.2	1.15.2
apache_software_foundation	apache_geode	>= 1.1.0 < 1.15.2	1.15.2

CWE-79