CVE-2022-34870

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.

Score

CVSS 3.1 5.4 Medium

Status

Modified - security@apache.org

Published

2022-10-25

Last modified

2025-05-09

Weaknesses

CWE-79

Affected products

• Geode (Apache)
• Apache Geode (Apache Software Foundation)

References

• http://www.openwall.com/lists/oss-security/2022/10/24/3
• https://lists.apache.org/thread/zltlr7f2ymr2m6jj54k4z0c4foos5fwx