CVE-2024-29198highexploração observadaCWE-918

CVE-2024-29198: falha de alta gravidade em geoserver

GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar geoserver+ Monitorar org.geoserver:gs-wfs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

58Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 7.5epss 2.3%
da publicação à arma
Publicada no NVD10 de jun.
VulnCheck+51d
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
geoserver · geoserver
CVEs relacionadas — geoserver

No mesmo produto, das mais perigosas para as menos.

CVE-2024-36401CRITICALRemote Code Execution (RCE) vulnerability in evaluating property name expressions in GeoserverEPSS 99.8%KEVCVE-2025-58360HIGHGeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap featureEPSS 61.2%KEVCVE-2023-25157CRITICALUnfiltered SQL Injection Vulnerabilities in GeoserverEPSS 85.2%CVE-2023-43795HIGHWPS Server Side Request Forgery in GeoServerEPSS 69.0%CVE-2025-30220CRITICALGeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handlingEPSS 43.6%CVE-2023-51444HIGHGeoServer arbitrary file upload vulnerability in REST Coverage Store APIEPSS 1.9%