Unfiltered SQL Injection Vulnerabilities in Geoserver
100Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 85%
de la publicación al arma105 días
Publicada en NVD21 feb
1ª PoC+105d
VulnCheck22 sept
probabilidad de explotación
85%top 1% de las CVE
explotación observada
síVulnCheck
18 exploit(s) público(s)
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
geoserver · geoserverPoCs públicas encontradas — 18
githubgithub.com/win3zz/CVE-2023-25157★ 170githubgithub.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158★ 14githubgithub.com/0x2458bughunt/CVE-2023-25157★ 10githubgithub.com/charis3306/CVE-2023-25157★ 3githubgithub.com/7imbitz/CVE-2023-25157-checker★ 3githubgithub.com/dr-cable-tv/Geoserver-CVE-2023-25157★ 2githubgithub.com/custiya/geoserver-CVE-2023-25157★ 0githubgithub.com/Rubikcuv5/CVE-2023-25157★ 0vulncheckvulncheck.com/xdb/3c03dd55def2no verificadovulncheckvulncheck.com/xdb/fd4dd3a61d34no verificadovulncheckvulncheck.com/xdb/281d65d4bbfcno verificadovulncheckvulncheck.com/xdb/036129b2f070no verificadovulncheckvulncheck.com/xdb/281183e04222no verificadovulncheckvulncheck.com/xdb/94494148cb01no verificadovulncheckvulncheck.com/xdb/9cf6c74ddc0ano verificadovulncheckvulncheck.com/xdb/b785e145c5f6no verificadovulncheckvulncheck.com/xdb/44aac331bc8bno verificadovulncheckvulncheck.com/xdb/5da0c67872dano verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.