CVE-2023-25157: fallo crítico en geoserver
Unfiltered SQL Injection Vulnerabilities in Geoserver
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
100Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 85%
de la publicación al arma105 días
Publicada en NVD21 feb
1ª PoC+105d
VulnCheck22 sept
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
geoserver · geoserverPoCs públicas encontradas — 20
githubgithub.com/win3zz/CVE-2023-25157★ 170githubgithub.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158★ 14githubgithub.com/0x2458bughunt/CVE-2023-25157★ 10githubgithub.com/charis3306/CVE-2023-25157★ 3githubgithub.com/7imbitz/CVE-2023-25157-checker★ 3githubgithub.com/dr-cable-tv/Geoserver-CVE-2023-25157★ 2githubgithub.com/Rubikcuv5/CVE-2023-25157★ 0githubgithub.com/custiya/geoserver-CVE-2023-25157★ 0vulncheckvulncheck.com/xdb/5da0c67872dano verificadovulncheckvulncheck.com/xdb/3c03dd55def2no verificadovulncheckvulncheck.com/xdb/fd4dd3a61d34no verificadovulncheckvulncheck.com/xdb/281d65d4bbfcno verificadovulncheckvulncheck.com/xdb/c68c49b562c2no verificadovulncheckvulncheck.com/xdb/036129b2f070no verificadovulncheckvulncheck.com/xdb/898e4ef1fc1bno verificadovulncheckvulncheck.com/xdb/281183e04222no verificadovulncheckvulncheck.com/xdb/94494148cb01no verificadovulncheckvulncheck.com/xdb/9cf6c74ddc0ano verificadovulncheckvulncheck.com/xdb/b785e145c5f6no verificadovulncheckvulncheck.com/xdb/44aac331bc8bno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — geoserver
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-36401CRITICALRemote Code Execution (RCE) vulnerability in evaluating property name expressions in GeoserverEPSS 99.8%KEVCVE-2025-58360HIGHGeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap featureEPSS 61.2%KEVCVE-2023-43795HIGHWPS Server Side Request Forgery in GeoServerEPSS 69.0%CVE-2025-30220CRITICALGeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handlingEPSS 43.6%CVE-2024-29198HIGHGeoServer Vulnerable to Unauthenticated SSRF via TestWfsPostEPSS 2.3%CVE-2023-51444HIGHGeoServer arbitrary file upload vulnerability in REST Coverage Store APIEPSS 1.9%