CVE-2023-25157

🗓️ 21 Feb 2023 21:00:13Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 426 Views🌐 WEB

GeoServer CVE-2023-25157 update to versions 2.21.4 or 2.22.2 recommende

Reporter	Title	Published	Views	Family All 32
GithubExploit	Exploit for SQL Injection in Osgeo Geoserver	10 Sep 202607:14	–	githubexploit
GithubExploit	Exploit for SQL Injection in Osgeo Geoserver	12 Jun 202314:34	–	githubexploit
GithubExploit	Exploit for SQL Injection in Osgeo Geoserver	10 Jun 202309:00	–	githubexploit
GithubExploit	Exploit for SQL Injection in Osgeo Geoserver	6 Jun 202314:05	–	githubexploit
GithubExploit	Exploit for SQL Injection in Osgeo Geoserver	13 Jul 202616:09	–	githubexploit
BDU FSTEC	The vulnerability of the software for managing and publishing geodata on the OSGeo GeoServer server lies in the lack of measures to neutralize special elements used in SQL queries, allowing a perpetrator to execute arbitrary SQL code.	13 Apr 202300:00	–	bdu_fstec
Circl	CVE-2023-25157	22 Feb 202300:47	–	circl
CNNVD	GeoServer SQL注入漏洞	21 Feb 202300:00	–	cnnvd
Cvelist	CVE-2023-25157 Unfiltered SQL Injection Vulnerabilities in Geoserver	21 Feb 202321:00	–	cvelist
Github Security Blog	GeoServer OGC Filter SQL Injection Vulnerabilities	22 Feb 202319:15	–	github

NVD

Vulners

Node

osgeo geoserverRange<2.18.7

osgeo geoserverRange2.19.0–2.19.7

osgeo geoserverRange2.20.0–2.20.7

osgeo geoserverRange2.21.0–2.21.4

osgeo geoserverRange2.22.0–2.22.2

[
  {
    "vendor": "geoserver",
    "product": "geoserver",
    "versions": [
      {
        "version": ">= 2.22.0, < 2.22.2",
        "status": "affected"
      },
      {
        "version": "< 2.21.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccf
github	www.github.com/geoserver/geoserver/commit/145a8af798590288d270b240235e89c8f0b62e1d

Parameter	Position	Path	Description	CWE
service	path	/geoserver/ows?service=wfs	CVE-2023-25157 described as an injection vulnerability via GeoServer OWS endpoints (WFS) with crafted requests.	CWE-89