PT-2023-3740 · Geoserver · Geoserver

Jody · Published 2023-06-12 · Updated 2025-08-15 · CVE-2023-35042

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GeoServer 2 (affected versions not specified)

Description The issue is related to insufficient input validation in the java.lang.Runtime.getRuntime().exec function of the GeoServer software, which can allow remote attackers to execute arbitrary code. This has been exploited in the wild in June 2023. The vendor states that they are unable to reproduce this in any version.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-04028

CVE-2023-35042

GHSA-59X6-G4JR-4HXC

Affected Products

Geoserver

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2023-35042 · Security Note
• https://osv.dev/vulnerability/GHSA-59x6-g4jr-4hxc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35042 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04028 · Security Note
• https://github.com/geoserver/geoserver · Note
• https://geosolutionsgroup.com/blog/geoserver-security-2023 · Note
• https://t.me/true_secator/7335 · Telegram Post
• https://osgeo-org.atlassian.net/browse/GEOS-10458 · Note
• https://isc.sans.edu/diary/29936 · Note
• https://t.me/cvenotify/52926 · Telegram Post
• https://docs.geoserver.org/stable/en/user/services/wps/operations.html#execute · Note
• https://geoserver.org/vulnerability/2022/04/11/geoserver-2-jiffle-jndi-rce.html · Note
• https://t.me/cvenotify/88595 · Telegram Post
• https://t.me/pentestingnews/36806 · Telegram Post