VulnerabilityAnalyzed

CVE-2024-29198

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

HIGH 8.2EPSS 2.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.

CVSS 3.1: 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS: 2.30% probability · 82th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: osgeo/geoserver
Source: security-advisories@github.com

References

https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxwMitigation, Third Party Advisory
https://osgeo-org.atlassian.net/browse/GEOS-11390Issue Tracking
https://osgeo-org.atlassian.net/browse/GEOS-11794Permissions Required

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.