GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GeoServer is an open source software server written in Java that allows users to share and edit geospatial
    data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language
    (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported
    through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to
    either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the
    PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and
    ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the
    ``FeatureId`` misuse. (CVE-2023-25157)

The GeoServer instance installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization through an OGC Common Query Language query.

ID	Name	Product	Family	Severity
412045	SCA: security update for org.geoserver.community:gs-jdbcconfig (GHSA-7g5f-wrx8-5ccf)	Tenable Cloud Security	SCA Checks	critical
412045	SCA: security update for org.geoserver.community:gs-jdbcconfig (GHSA-7g5f-wrx8-5ccf)	Tenable Self-Hosted Container Security	SCA Checks	critical
113959	GeoServer SQL Injection	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2023-25157

critical

Tenable Plugins

critical

critical

critical