CVE-2025-47410: Apache Geode geode-web Package Vulnerable to CSRF Attacks via Management and Monitoring REST API
Summary
CVE-2025-47410: Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malic... Affects org.apache.geode:geode-web versions >= 1.10.0, < 1.15.2. Fixed in 1.15.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Geode is an open-source data management platform that provides a distributed in-memory data grid. It is designed to enable high-performance applications by allowing users to store and manage data in a scalable and fault-tolerant manner. The geode-web package specifically offers a web-based interface for managing and monitoring Geode clusters. However, it is susceptible to Cross-Site Request Forgery (CSRF) attacks, which can compromise user sessions and lead to unauthorized command execution.
Vulnerability Detail
The vulnerability arises from the Management and Monitoring REST API of Apache Geode, which allows GET requests without adequate CSRF protection. An attacker can exploit this by tricking a user into making a GET request that executes malicious commands on the target system, leveraging the user's authenticated session. This could lead to unauthorized access and manipulation of data, posing significant security risks to the affected system.
How To Fix
Minimum fixed version
1.15.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement additional CSRF protection mechanisms in their applications, such as validating CSRF tokens for sensitive operations. However, upgrading to the patched version is the recommended approach for long-term security.
Conclusion
In summary, CVE-2025-47410 is a significant vulnerability in the Apache Geode geode-web package that exposes users to CSRF attacks. It is crucial for users to upgrade to version 1.15.2 to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for org.apache.geode:geode-web →
FAQ
CVE-2025-47410 is a vulnerability in the Apache Geode geode-web package that allows CSRF attacks through GET requests to its Management and Monitoring REST API.
The vulnerability affects Apache Geode versions 1.10.0 through 1.15.1.
You can use Vulert, which monitors open-source vulnerabilities in real-time using just the pom.xml file. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If immediate upgrading is not possible, consider implementing additional CSRF protection measures as a temporary workaround.
