Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Apache Geode web API may execute malicious script

CVE-2024-44088 · published 1 year ago
Summary

The web API used by Apache Geode can be tricked into running code supplied in a crafted link, potentially letting an attacker steal a logged‑in user's session and take over the account. This affects all Geode versions before 1.15.2. Update the software to version 1.15.2 or later to eliminate the risk.

What to do
  • Update apache org.apache.geode:geode-web-api to version 1.15.2.
  • Update apache geode to version 1.15.2 or later.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.geode:geode-web-api >= 1.1.0, < 1.15.2
Fix: upgrade to 1.15.2
– apache geode >= 1.1.0, < 1.15.2
cpe:2.3:a:apache:geode:*:*:*:*:*:*:*:*
Original advisory text
Apache Geode: Reflected XSS
Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information and even account takeover.



This issue affects Apache Geode: all versions prior to 1.15.2

Users are recommended to upgrade to version 1.15.2, which fixes the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published14 Oct 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-w595-4975-gm3h · GHSA
CVE-2024-44088 · NVD
CVE-2024-44088 · OSV
Track software like this
Free during beta