Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.
AnalysisAI
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version. Affected products include: Geoserver.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
GeoServer contains an XXE vulnerability in the WMS GetMap operation allowing unauthenticated attackers to read server fi
GeoServer is an open source server that allows users to share and edit geospatial data. Rated critical severity (CVSS 9.
A remote code execution vulnerability in GeoServer (CVSS 9.9) that allows users. Risk factors: public PoC available. Ven
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. Rated c
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. Rated c
GeoServer contains a Server-Side Request Forgery (SSRF) vulnerability in the Demo request endpoint (TestWfsPost servlet)
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. Rated m
GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the def
GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispa
CVE-2024-34711 is an improper URI validation vulnerability in GeoServer that allows unauthenticated attackers to bypass
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. Rated m
Denial-of-service vulnerability in GeoServer that allows unauthenticated remote attackers to execute malicious Jiffle sc
Share
External POC / Exploit Code
Leaving vuln.today