PT-2025-24673 · Unknown+3 · Geonetwork+3
Xbow-Security
+1
·
Published
2025-06-09
·
Updated
2026-03-13
·
CVE-2025-30220
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
GeoServer versions prior to 2.27.1
GeoServer versions prior to 2.26.3
GeoServer versions prior to 2.25.7
GeoTools versions prior to 33.1
GeoTools versions prior to 32.3
GeoTools versions prior to 31.7
GeoTools versions prior to 28.6.1
GeoNetwork versions prior to 4.4.8
GeoNetwork versions prior to 4.2.13
Description
The issue is related to the use of the Eclipse XSD library in the GeoTools Schema class, which is vulnerable to XML External Entity (XXE) exploit. This affects users who expose XML processing with gt-xsd-core involved in parsing when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler. This also impacts users of gt-wfs-ng DataStore where the ENTITY RESOLVER connection parameter was not being used as intended.
Recommendations
For GeoServer versions prior to 2.27.1, update to version 2.27.1 or later.
For GeoServer versions prior to 2.26.3, update to version 2.26.3 or later.
For GeoServer versions prior to 2.25.7, update to version 2.25.7 or later.
For GeoTools versions prior to 33.1, update to version 33.1 or later.
For GeoTools versions prior to 32.3, update to version 32.3 or later.
For GeoTools versions prior to 31.7, update to version 31.7 or later.
For GeoTools versions prior to 28.6.1, update to version 28.6.1 or later.
For GeoNetwork versions prior to 4.4.8, update to version 4.4.8 or later.
For GeoNetwork versions prior to 4.2.13, update to version 4.2.13 or later.
Exploit
Fix
SSRF
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Eclipse Xsd
Geonetwork
Geoserver
Geotools