[<prev] [next>] [day] [month] [year] [list]
Message-ID: <aeebc9d5-8d3f-f6fd-c49b-d35e5fe5326c@apache.org>
Date: Tue, 14 Oct 2025 14:06:40 +0000
From: William Hodges <whodges@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-44088: Apache Geode: Reflected XSS
Severity: moderate
Affected versions:
- Apache Geode (org.apache.geode:geode-web-api) 1.1.0 before 1.15.2
Description:
Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information and even account takeover.
This issue affects Apache Geode: all versions prior to 1.15.2
Users are recommended to upgrade to version 1.15.2, which fixes the issue.
Credit:
Nbxiglk (finder)
References:
https://geode.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-44088
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
