Description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. This version of GeoServer is vulnerable to an SQL injection vulnerability.

Remediation

Upgrade to the latest version of GeoServer

References

GeoServer OGC Filter SQL Injection Vulnerabilities

GeoServer & GeoTools SQL Injection (CVE-2023-25157 & CVE-2023-25158)

Related Vulnerabilities

Oracle Database Server CVE-2007-0268 Vulnerability (CVE-2007-0268)

ClipBucket Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2018-7664)

IBM RTC Improper Restriction of XML External Entity Reference Vulnerability (CVE-2017-1103)

phpMyFAQ Improper Neutralization of Formula Elements in a CSV File Vulnerability (CVE-2023-4006)

Rukovoditel Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-13592)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Denial Of Service Known Vulnerabilities SQL Injection CWE-89 CVE-2023-25157