{"id":"CVE-2022-34870","aliases":["EUVD-2022-7000","GHSA-373r-9mg8-3jc4"],"status":"published","title":"Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application","description":"Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01375,"percentile":0.72219,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-10-25T00:00:00Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"Maven","package":"org.apache.geode:geode-core","fixed_in":["1.15.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.geode:geode-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.geode:geode-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1"}]}],"versions":["1.0.0-incubating","1.0.0-incubating.M2","1.0.0-incubating.M3","1.1.0","1.1.1","1.10.0","1.11.0","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.14.0","1.14.1","1.14.2","1.14.3","1.14.4","1.15.0","1.2.0","1.2.1","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0","1.9.1","1.9.2"]}],"products":[{"vendor":"apache","product":"geode"},{"vendor":"apache software foundation","product":"apache geode"}],"references":[{"url":"https://lists.apache.org/thread/zltlr7f2ymr2m6jj54k4z0c4foos5fwx","tags":["x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/10/24/3","tags":["mailing-list","x_transferred","Third Party Advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34870","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-373r-9mg8-3jc4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/34xxx/CVE-2022-34870.json","tags":["advisory"]},{"url":"https://github.com/apache/geode","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-34870","title":"Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application","description":"Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2025-05-09T18:54:23.644Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:42.028422Z"}],"euvd":[{"id":"EUVD-2022-7000","description":"Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2025-05-09T18:54:23Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:50.734545Z"}],"ghsa":[{"id":"GHSA-373r-9mg8-3jc4","title":"Apache Geode vulnerable to Cross-Site Scripting","description":"Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.","status":"published","published":"2022-10-25T19:00:27Z","modified":"2023-01-30T05:02:58Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2022-34870","description":"Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.","status":"published","published":"2022-10-25T17:15:53.683Z","modified":"2026-06-17T04:51:04.353Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"CVE-2022-34870","title":"Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application","description":"Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2026-10-28T02:30:58.258671019Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"GHSA-373r-9mg8-3jc4","title":"Apache Geode vulnerable to Cross-Site Scripting","description":"Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.","status":"published","published":"2022-10-25T19:00:27Z","modified":"2023-11-08T04:09:49.31706Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}