Description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. This version of GeoServer is vulnerable to an SQL injection vulnerability.

Remediation

Upgrade to the latest version of GeoServer

References

GeoServer OGC Filter SQL Injection Vulnerabilities

GeoServer & GeoTools SQL Injection (CVE-2023-25157 & CVE-2023-25158)

Related Vulnerabilities

Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-2609)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-7480)

Claroline Other Vulnerability (CVE-2006-1594)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3393)

SugarCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-28956)

Severity

High

Classification

CVE-2023-25157 CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Denial Of Service Known Vulnerabilities SQL Injection