PT-2025-41925

CVE-2024-44088

Published

2025-10-14

Updated

2025-10-17

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.15.2

Description A malicious script injection issue exists in the Apache Geode web-api (REST). An attacker can trick a logged-in user into clicking a specially-crafted link, leading to code execution on the returned page. This could result in the theft of the user's session information and potential account takeover. The vulnerability impacts the REST API.

Recommendations Upgrade to version 1.15.2, which resolves the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2024-44088