VDB
BDU%3A2025-10404
BDU%3A2025-10404
PUBLISHED
CVSS 7.5 HIGH
Уязвимость веб-сервиса GeoServer Web Feature Service (WFS) программного обеспечения для администрирования и публикации геоданных на сервере OSGeo GeoServer, позволяющая нарушителю раскрыть защищаемую информацию
Risk Scores
CVSS 3.1
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Open Source Geospatial Foundation (OSGeo) | GeoTools, GeoServer | |
| geoserver | geoserver | >= 2.27.0, < 2.27.1, >= 2.26.0, < 2.26.3, < 2.25.7 |
Timeline
- Jun 10, 2025 PoC Published
- Jun 17, 2025 PoC Published
- Jun 18, 2025 PoC Published
- Jun 20, 2025 PoC Published
- Jul 24, 2025 PoC Published
- Jul 27, 2025 PoC Published
- Jul 28, 2025 PoC Published
- Aug 2, 2025 PoC Published
- Aug 3, 2025 PoC Published
- Aug 5, 2025 PoC Published
- Aug 7, 2025 PoC Published
- Aug 13, 2025 PoC Published
References
- https://github.com/geonetwork/core-geonetwork/pull/8803 url
- https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc url
- https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw url
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc url
- https://github.com/geonetwork/core-geonetwork/pull/8757 url
- https://github.com/geonetwork/core-geonetwork/pull/8812 url
- https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities url