Apache Geode web-api versions prior to 1.15.2 contain a Cross-site Scripting (XSS) vulnerability (CVE-2024-44088). This flaw allows attackers to inject malicious scripts that execute in the context of a logged-in user's browser when they click a crafted link. Successful exploitation can lead to theft of session information and potential account takeover. The vulnerability is fixed in version 1.15.2.