Lucene search

K
cve[email protected]CVE-2022-24847
HistoryApr 13, 2022 - 10:15 p.m.

CVE-2022-24847

2022-04-1322:15:08
CWE-917
CWE-20
web.nvd.nist.gov
672
geoserver
java
security
vulnerability
nvd
jndi lookup
arbitrary code execution
upgrade
geowebcache

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

41.0%

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 1.19.6. Users unable to upgrade should restrict access to the geoserver/web and geoserver/rest via a firewall and ensure that the GeoWebCache is not remotely accessible.

Affected configurations

Vulners
NVD
Node
geoservergeoserverRange2.20.02.20.4
OR
geoservergeoserverRange<2.19.6
VendorProductVersionCPE
geoservergeoserver*cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
geoservergeoserver*cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "geoserver",
    "vendor": "geoserver",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.20.0, < 2.20.4"
      },
      {
        "status": "affected",
        "version": "< 2.19.6"
      }
    ]
  }
]

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

41.0%

Related for CVE-2022-24847