HIGHFixed upstream

CVE-2025-47410

Apache Geode: CSRF through GET requests to the Management and Monitoring REST API

Technology

GemFire / Geode

CVSS Score

8.8 / 10.0

Affected Versions

Apache Geode 1.10.0 to 1.15.1

Upstream Fix

1.15.2

Published

October 18, 2025

OSSeva Coverage

Fixed upstream

Description

The Management and Monitoring REST API accepts state-changing GET requests, so an attacker who tricks a user with a Geode session can submit gfsh commands on the target system as that user. The 8.8 score on NVD is from CISA-ADP.

Upstream record: NVD · CVE.org

Is your GemFire / Geode deployment affected?

If you're running Apache Geode 1.10.0 to 1.15.1, you need this patch. Book a discovery call to get covered.

Book a discovery call View GemFire / Geode coverage →