Design/Logic Flaw

Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52104

Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52104

Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52104

Technical details about CVE-2023-52104 are not publicly available in the provided documents. Monitor for updates from official advisories and vendor bulletins for affected products, versions, impact, and remediation.

CVE-2023-52102

Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52102

Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52102

CVE-2023-52102 concerns a parameter verification failure in the WMS module of Huawei HarmonyOS/HarmonyOS-derived components. The root cause is listed as parameters not being verified, leading to potential confidentiality leakage. The CVSSv3.1 data indicates a network-accessible, low-complexity is...

CVE-2023-52107

Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

Design/Logic Flaw

Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52107

CVE-2023-52107 affects Huawei HarmonyOS (and EMUI) WMS module where permissions are not strictly verified, constituting a privilege-checking laxity vulnerability. Descriptions across sources indicate that exploitation could compromise service confidentiality. The CVSS metrics (AV:N/AC:L/PR:N/UI:N...

CVE-2023-52107

Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52107

Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

PT-2024-14401 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a vulnerability where parameters are not verified in the WMS module. Successful exploitation of this vulnerability may affect service...

CVE-2023-41339

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles,...

CVE-2023-41339 Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles,...

CVE-2023-41339 Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles,...

CVE-2023-41339

GeoServer exposes a Server-Side Request Forgery (SSRF) risk via the dynamic styling parameter sld= in GetMap/GetLegendGraphic/GetFeatureInfo when URL checks are not configured. The vulnerability enables an attacker to cause the server to fetch external resources, potentially capturing NetNTLMv2 h...

GHSA-CQPC-X2C6-2GMF Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF

Summary The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. It is possibl...

Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF

Summary The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. It is possibl...

PT-2023-27915 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.22.5 GeoServer versions prior to 2.23.2 GeoServer version 2.10.3 GeoServer version 2.11.1 Description: The issue concerns the use of dynamic styles in GeoServer, which can lead to Service Side Request Forgery. Th...