PT-2023-3740 · Geoserver · Geoserver

Jody · Publicado 2023-06-12 · Atualizado 2025-08-15 · CVE-2023-35042

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GeoServer 2 (affected versions not specified)

Description The issue is related to insufficient input validation in the java.lang.Runtime.getRuntime().exec function of the GeoServer software, which can allow remote attackers to execute arbitrary code. This has been exploited in the wild in June 2023. The vendor states that they are unable to reproduce this in any version.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-04028

CVE-2023-35042

GHSA-59X6-G4JR-4HXC

Produtos afetados

Geoserver

Referências · 14

• https://github.com/geoserver/geoserver · Nota
• https://osgeo-org.atlassian.net/browse/GEOS-10458 · Nota
• https://geosolutionsgroup.com/blog/geoserver-security-2023 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-35042 · Nota de Segurança
• https://docs.geoserver.org/stable/en/user/services/wps/operations.html#execute · Nota
• https://t.me/cvenotify/88595 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-35042 · Aviso do Fabricante
• https://geoserver.org/vulnerability/2022/04/11/geoserver-2-jiffle-jndi-rce.html · Nota
• https://t.me/pentestingnews/36806 · Publicação no Telegram
• https://t.me/cvenotify/52926 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-04028 · Nota de Segurança
• https://isc.sans.edu/diary/29936 · Nota
• https://osv.dev/vulnerability/GHSA-59x6-g4jr-4hxc · Aviso do Fabricante
• https://t.me/true_secator/7335 · Publicação no Telegram