cve.bz

CVE-2023-25157

9.8 criticalEPSS 85%

Critical (9.8) in osgeo geoserver. EPSS 85% chance of exploitation in the next 30 days. Fixed in org.geoserver.community:gs-jdbcconfig 2.21.4, 2.22.2.

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
85% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-89
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-7g5f-wrx8-5ccfMavenorg.geoserver.community:gs-jdbcconfig<2.21.42.21.4
GHSA-7g5f-wrx8-5ccfMavenorg.geoserver.community:gs-jdbcconfig>=2.22.0 <2.22.22.22.2

References

Check your stackJSON