PT-2022-16921 · Geoserver · Geoserver

Jodygarnett · Published 2022-04-13 · Updated 2025-12-29 · CVE-2022-24847

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

High

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.21.0 GeoServer versions prior to 2.20.4 GeoServer versions prior to 1.19.6

Description The GeoServer security mechanism can perform an unchecked JNDI lookup, which can be used to perform class deserialization and result in arbitrary code execution. This can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. To exploit this, an attack needs to have obtained admin rights and use either the GeoServer GUI or its REST API.

Recommendations For versions prior to 2.21.0, restrict access to the geoserver/web and geoserver/rest via a firewall and ensure that the GeoWebCache is not remotely accessible. For versions prior to 2.20.4, restrict access to the geoserver/web and geoserver/rest via a firewall and ensure that the GeoWebCache is not remotely accessible. For versions prior to 1.19.6, restrict access to the geoserver/web and geoserver/rest via a firewall and ensure that the GeoWebCache is not remotely accessible.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-917

Related Identifiers

BDU:2025-04925

CVE-2022-24847

GHSA-4PM3-F52J-8GGH

Affected Products

Geoserver

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24847.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24847 · Security Note
• https://bdu.fstec.ru/vul/2025-04925 · Security Note
• https://osv.dev/vulnerability/GHSA-4pm3-f52j-8ggh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24847 · Vendor Advisory
• https://github.com/geoserver/geoserver · Note
• https://github.com/geoserver/geoserver/security/advisories/GHSA-4pm3-f52j-8ggh · Note
• https://github.com/geoserver/geoserver/commit/b94a69943992df999d627b21a4ed056fad4569f8 · Note
• https://t.me/cibsecurity/40747 · Telegram Post
• https://t.me/cvenotify/28891 · Telegram Post
• https://twitter.com/Loginsoft_Intel/status/2005753385958711703 · Twitter Post