Unfiltered SQL Injection Vulnerabilities in Geoserver
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.22.2, 2.21.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 10 proofs of concept on GitHub, 1 Nuclei template
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore encode functions setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore preparedStatements setting to mitigate the ``FeatureId`` misuse.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- geoserver geoserver
From 2.22.0 · fixed in 2.22.2; fixed in 2.21.4
- org.geoserver.community:gs-jdbcconfigMaven
fixed in 2.21.4
- org.geoserver.community:gs-jdbcconfigMaven
From 2.22.0 · fixed in 2.22.2