Apache Software Foundation Apache Geode vulnerabilities

CVE-2025-47410 [HIGH] CWE-352 CVE-2025-47410: Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring RES Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15

CVE-2024-44088 [MEDIUM] CWE-79 CVE-2024-44088: Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). Th Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information and even account takeover. This issue affects Ap

CVE-2022-34870 [MEDIUM] CWE-79 CVE-2022-34870: Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.

CVE-2022-37021 [CRITICAL] CWE-502 CVE-2022-37021: Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrust Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrad

CVE-2022-37022 [HIGH] CWE-502 CVE-2022-37022: Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks.

CVE-2022-37023 [MEDIUM] CWE-502 CVE-2022-37023: Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw whe Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and sp

CVE-2021-34797 [HIGH] CWE-532 CVE-2021-34797: Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive in Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apa

CVE-2017-15695 [HIGH] CWE-863 CVE-2017-15695: When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user wi When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.

CVE-2017-15692 [CRITICAL] CWE-502 CVE-2017-15692: In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that dese In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classes are present on the classpath.

CVE-2017-15693 [HIGH] CWE-502 CVE-2017-15693: In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certa In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.

CVE-2017-15696 [HIGH] CWE-200 CVE-2017-15696: When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration serv When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.

CVE-2017-9795 [HIGH] CWE-200 CVE-2017-9795: When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to s When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code execution.

CVE-2017-12622 [HIGH] CWE-200 CVE-2017-12622: When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user con When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges.

CVE-2017-9796 [MEDIUM] CWE-200 CVE-2017-9796: When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to s When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions.

CVE-2017-9797 [MEDIUM] CWE-200 CVE-2017-9797: When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client ca When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of service attack on the cluster.

CVE-2017-9794 [MEDIUM] CWE-200 CVE-2017-9794: When a cluster is operating in secure mode, a user with read privileges for specific data regions ca When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing data that the user is not authorized to view.

CVE-2017-5649 [HIGH] CWE-200 CVE-2017-5649: Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager prope Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the cluster.