CVE-2024-44088

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
6.1MEDIUM
EPSS
0.1%
top 70.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache GeodeApache Geode
Timeline
PublishedOct 14

Description

Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information and even account takeover. This issue affects Apache Geode: all versions prior to 1.15.2 Users are recommended to upgrade to version 1.15.2, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDapache/geode1.1.0 — 1.15.2
▶Mavenorg.apache.geode:geode-web-api1.1.0 — 1.15.2
▶CVEListV5apache_software_foundation/apache_geode1.1.0 — 1.15.2

🔴Vulnerability Details

3
CVEList
Apache Geode: Reflected XSS↗2025-10-14
▶
OSV
Apache Geode web-api is vulnerable to Cross-site Scripting↗2025-10-14
▶
GHSA
Apache Geode web-api is vulnerable to Cross-site Scripting↗2025-10-14
▶
CVE-2024-44088 (MEDIUM CVSS 6.1) | Malicious script injection ('Cross- | cvebase.io