CVE-2024-44088: Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in…

PriorityP431medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.64%

46.5th percentile

Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information and even account takeover. This issue affects Apache Geode: all versions prior to 1.15.2 Users are recommended to upgrade to version 1.15.2, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	geode	>= 1.1.0 < 1.15.2	1.15.2
apache_software_foundation	apache_geode	>= 1.1.0 < 1.15.2	1.15.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.