CRITICAL🇵🇱 Wersja polska

CVE-2023-35042

CVSS 9.8v3.1pub. 2023-06-12upd. 2024-11-21

GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Geoserver

    APP
    Geoserver
    ≥ 2.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2024-36401CRITICAL9.8⚠ KEVPL ✓ten sam produkt

GeoServer RCE przez niezabezpieczoną ewaluację XPath w parametrach OGC

CVE-2025-58360HIGH8.2⚠ KEVten sam produkt

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to...

CVE-2024-24749HIGH7.5ten sam produkt

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23...

CVE-2023-51444HIGH7.2ten sam produkt

GeoServer is an open source software server written in Java that allows users to share and edit geospatial dat...

CVE-2023-41877HIGH7.2ten sam produkt

GeoServer is an open source software server written in Java that allows users to share and edit geospatial dat...