CVE-2022-24847: high-severity vulnerability in geoserver
Improper Input Validation in GeoServer
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
43Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 7.2epss 1.6%
from disclosure to weapon
Published on NVDApr 13
VulnCheck+825d
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 1.19.6. Users unable to upgrade should restrict access to the `geoserver/web` and `geoserver/rest` via a firewall and ensure that the GeoWebCache is not remotely accessible.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
geoserver · geoserverRelated CVEs — geoserver
In the same product, most dangerous first.
CVE-2024-36401CRITICALRemote Code Execution (RCE) vulnerability in evaluating property name expressions in GeoserverEPSS 99.8%KEVCVE-2025-58360HIGHGeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap featureEPSS 61.2%KEVCVE-2023-25157CRITICALUnfiltered SQL Injection Vulnerabilities in GeoserverEPSS 85.2%CVE-2023-43795HIGHWPS Server Side Request Forgery in GeoServerEPSS 69.0%CVE-2025-30220CRITICALGeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handlingEPSS 43.6%CVE-2024-29198HIGHGeoServer Vulnerable to Unauthenticated SSRF via TestWfsPostEPSS 2.3%