** DISPUTED ** GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.
References
| Link | Resource |
|---|---|
| https://docs.geoserver.org/stable/en/user/services/wps/operations.html#execute | Product |
| https://isc.sans.edu/diary/29936 | Third Party Advisory |
Configurations
History
07 Jul 2023, 15:28
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| References | (MISC) https://isc.sans.edu/diary/29936 - Third Party Advisory | |
| References | (MISC) https://docs.geoserver.org/stable/en/user/services/wps/operations.html#execute - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| Summary | ** DISPUTED ** GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version. | |
| CPE | cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:* |
12 Jun 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-12 15:15
Updated : 2024-08-02 17:15
NVD link : CVE-2023-35042
Mitre link : CVE-2023-35042
CVE.ORG link : CVE-2023-35042
JSON object : View
Products Affected
geoserver
- geoserver
CWE