GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
58Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.5epss 1.9%
from disclosure to weapon
Published on NVDJun 10
VulnCheck+51d
exploitation probability
1.9%top 22% of all CVEs
observed exploitation
yesVulnCheck
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
geoserver · geoserver