CVE-2024-36401

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

This vulnerability affects an open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv, https://github.com/geotools/geotools/pull/4797 ; https://nvd.nist.gov/vuln/detail/CVE-2024-36401

Remediation deadline: August 5, 2024

Description

OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.

Timeline

Published:July 15th, 2024 12:00 AM

Last modified:July 15th, 2024 12:00 AM

Added to KEV:July 15th, 2024

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

OSGeo

Products

GeoServer

Weaknesses (CWE)

CWE-95

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute