-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability is a Cross-Site Scripting (XSS) issue in the Apache Geode web-api. The description mentions that an attacker can trick a logged-in user into clicking a specially-crafted link, which is a typical vector for reflected XSS and usually involves a GET request. I analyzed the commits between the vulnerable version (1.15.1) and the patched version (1.15.2). I found a commit with the message 'Disallow GET requests to /management/commands endpoint'. This commit modifies the ShellCommandsController.java file and changes the @RequestMapping for the command method to only allow POST requests, removing GET. This directly addresses the vulnerability as described. The vulnerable function is therefore org.apache.geode.management.internal.web.controllers.ShellCommandsController.command, which was processing the user-provided cmd parameter without sufficient validation, leading to the XSS vulnerability when accessed via a GET request.
org.apache.geode.management.internal.web.controllers.ShellCommandsController.commandgeode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.geode:geode-web-api | maven | >= 1.1.0, < 1.15.2 | 1.15.2 |
Ongoing coverage of React2Shell