PT-2025-48090 · Opengeo · Geoserver

Published 2024-02-08 · Updated 2025-11-25 · CVE-2025-21621

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.25.0

Description A reflected cross-site scripting (XSS) issue exists in the WMS GetFeatureInfo HTML output format. This allows a remote attacker to execute arbitrary JavaScript code in a victim's browser through specially crafted SLD BODY parameters. The WMS service setting that controls HTML auto-escaping is either disabled by default or completely missing in affected versions. If an attacker can control a script executed in the victim’s browser, they can perform actions, view information, modify data, and initiate interactions with other application users.

Recommendations Versions prior to 2.25.0 should be updated to version 2.25.0 or later. Enable GetFeatureInfo HTML auto-escaping (available in GeoServer 2.21.3 and 2.22.1). Disable dynamic styling. Disable GetFeatureInfo text/html MIME type.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-14927

CVE-2025-21621

GHSA-W66H-J855-QR72

Affected Products

Geoserver

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21621.json · Exploit
• https://github.com/geoserver/geoserver/security/advisories/GHSA-w66h-j855-qr72 · Vendor Advisory
• https://github.com/geoserver/geoserver/commit/dc9ff1c726dd73c884437a123b4ad72b19383c7d · Patch
• https://osv.dev/vulnerability/CVE-2025-21621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21621 · Security Note
• https://bdu.fstec.ru/vul/2025-14927 · Security Note
• https://osv.dev/vulnerability/GHSA-w66h-j855-qr72 · Vendor Advisory
• https://github.com/geoserver/geoserver · Note
• https://github.com/geoserver/geoserver/pull/7406 · Note
• https://osgeo-org.atlassian.net/browse/GEOS-11203 · Note
• https://twitter.com/VulmonFeeds/status/1993453102888886592 · Twitter Post
• https://osgeo-org.atlassian.net/browse/GEOS-11297 · Note
• https://t.me/CVEtracker/38233 · Telegram Post
• https://twitter.com/CVEnew/status/1993443639503311016 · Twitter Post