Apache Geode CVE-2025-47410

Exploitation requires that the Management and Monitoring REST API accepts state-changing operations via GET requests (the specific weakness named in the description), that a victim holds a currently-valid authenticated Geode session, and that this victim is successfully social-engineered into loading attacker-controlled web content (UI:R). Limiting factors: the attack cannot succeed without an active privileged session and user interaction; it is bounded to actions the victim's account is authorized to perform; and it is mitigated by upgrading to Geode 1.15.2 or by not exposing the Management/Monitoring REST API to browsers that can reach untrusted content. This is not remote unauthenticated exploitation against a default configuration - it depends on a privileged human victim.

The input signals are moderately consistent but incomplete. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) marks this network-reachable and low-complexity, but the PR:N rating is a CSRF artifact - the attacker never authenticates; they ride a victim's existing Geode session, and the UI:R flag confirms that successful exploitation DEPENDS on tricking an authenticated user into interacting with attacker content. No EPSS score, no CISA KEV entry, and no POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV/POC is not evidence of safety but means there is no signal of active, widespread exploitation - consistent with a CSRF class flaw that is opportunistic and victim-dependent rather than mass-automatable. One caveat to verify: the C:H rating is questionable for classic CSRF, since the same-origin policy normally prevents the attacker from reading the response to the forged GET request; the realistic impact is forged state-changing management commands (integrity/availability) rather than direct data disclosure, so the true confidentiality impact may be lower than the vendor vector states. Net: a genuine but conditional issue requiring social engineering of a privileged Geode operator, not a drive-by unauthenticated RCE despite the high base score.

An attacker crafts a web page or email containing a hidden GET request targeting an internal Apache Geode Management and Monitoring REST API endpoint. When a currently-authenticated Geode administrator is lured into loading that content, their browser automatically replays their valid session credentials, causing the forged management command to execute with the admin's privileges. No public exploit code is identified at time of analysis, but the GET-based CSRF is trivial to weaponize as a crafted link or auto-submitting page.