Vulnerability Description
Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.
CVSS Score
5.4
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Geode | <= 1.15.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/10/24/3Third Party Advisory
- https://lists.apache.org/thread/zltlr7f2ymr2m6jj54k4z0c4foos5fwxIssue TrackingVendor Advisory
- http://www.openwall.com/lists/oss-security/2022/10/24/3Third Party Advisory
- https://lists.apache.org/thread/zltlr7f2ymr2m6jj54k4z0c4foos5fwxIssue TrackingVendor Advisory
FAQ
What is CVE-2022-34870?
CVE-2022-34870 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.
How severe is CVE-2022-34870?
CVE-2022-34870 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-34870?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Geode.