CVE-2024-44088: Apache Geode web-api is vulnerable to Cross-site Scripting

The vulnerability is a Cross-Site Scripting (XSS) issue in the Apache Geode web-api. The description mentions that an attacker can trick a logged-in user into clicking a specially-crafted link, which is a typical vector for reflected XSS and usually involves a GET request. I analyzed the commits between the vulnerable version (1.15.1) and the patched version (1.15.2). I found a commit with the message 'Disallow GET requests to /management/commands endpoint'. This commit modifies the ShellCommandsController.java file and changes the @RequestMapping for the command method to only allow POST requests, removing GET. This directly addresses the vulnerability as described. The vulnerable function is therefore org.apache.geode.management.internal.web.controllers.ShellCommandsController.command, which was processing the user-provided cmd parameter without sufficient validation, leading to the XSS vulnerability when accessed via a GET request.