Apache Geode vulnerable to Cross-Site Scripting

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-34870 · ADVISORY
• apache/geode · PACKAGE
• lists.apache.org/thread/zltlr7f2ymr2m6jj54k4z0c4foos5fwx · WEB
• openwall.com/lists/oss-security/2022/10/24/3 · WEB

More vulnerabilities in org.apache.geode:geode-core

• CVE-2022-37023MEDIUM 6.5Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. A…
• CVE-2022-37022HIGH 8.8Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11.…
• CVE-2022-37021CRITICAL 9.8Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on …
• CVE-2021-34797HIGH 7.5Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that be…
• CVE-2019-10091HIGH 7.4When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries…