Description
GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.
Remediation
References
Related Vulnerabilities
MySQL CVE-2021-35644 Vulnerability (CVE-2021-35644)
MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2024-40601)
WordPress Plugin Product Catalog for WordPress Unspecified Vulnerability (1.4.5)
WordPress Plugin AJAX Random Post Cross-Site Scripting (2.00)
WordPress 'press-this.php' Multiple Cross-Site Scripting Vulnerabilities (2.0 - 2.5.1)