CVE-2023-25157

🗓️ 21 Feb 2023 21:00:13Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 277 Views🌐 WEB

GeoServer CVE-2023-25157 update to versions 2.21.4 or 2.22.2 recommende

Reporter	Title	Published	Views	Family All 17
GithubExploit	Exploit for SQL Injection in Osgeo Geoserver	12 Jun 202314:34	–	githubexploit
GithubExploit	Exploit for SQL Injection in Osgeo Geoserver	6 Jun 202314:05	–	githubexploit
Circl	CVE-2023-25157	22 Feb 202300:47	–	circl
CNNVD	GeoServer SQL注入漏洞	21 Feb 202300:00	–	cnnvd
Cvelist	CVE-2023-25157 Unfiltered SQL Injection Vulnerabilities in Geoserver	21 Feb 202321:00	–	cvelist
Github Security Blog	GeoServer OGC Filter SQL Injection Vulnerabilities	22 Feb 202319:15	–	github
NCSC	Vulnerabilities fixed in GeoServer	7 Jun 202300:00	–	ncsc
Nuclei	GeoServer OGC Filter - SQL Injection	28 May 202605:39	–	nuclei
NVD	CVE-2023-25157	21 Feb 202322:15	–	nvd
OSV	CVE-2023-25157 Unfiltered SQL Injection Vulnerabilities in Geoserver	21 Feb 202321:00	–	osv

NVD

Vulners

Node

osgeo geoserverRange<2.18.7

osgeo geoserverRange2.19.0–2.19.7

osgeo geoserverRange2.20.0–2.20.7

osgeo geoserverRange2.21.0–2.21.4

osgeo geoserverRange2.22.0–2.22.2

[
  {
    "vendor": "geoserver",
    "product": "geoserver",
    "versions": [
      {
        "version": ">= 2.22.0, < 2.22.2",
        "status": "affected"
      },
      {
        "version": "< 2.21.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccf
github	www.github.com/geoserver/geoserver/commit/145a8af798590288d270b240235e89c8f0b62e1d

Parameter	Position	Path	Description	CWE
service	query param	/geoserver/ows?service=wfs	CVE-2023-25157 related vulnerability in GeoServer via WFS requests	CWE-89
request	query param	/geoserver/ows?service=wfs	CVE-2023-25157 related vulnerability in GeoServer via WFS requests	CWE-89
version	query param	/geoserver/ows?service=wfs	CVE-2023-25157 related vulnerability in GeoServer via WFS requests	CWE-89
typeName	query param	/geoserver/ows?service=wfs	CVE-2023-25157 related vulnerability in GeoServer via WFS requests	CWE-89
outputFormat	query param	/geoserver/ows?service=wfs	CVE-2023-25157 related vulnerability in GeoServer via WFS requests	CWE-89