CVE-2025-27511
🟡 Monitoruj
Atak JNDI w GeoServer DB2 DataStore umożliwia zdalne wykonanie kodu.
CVSS
7.2
EPSS
1.1%
Exploit
none
Vendor
osgeo
Opis źródłowy (NVD)
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.
rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.2 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 1.1% |
| Opublikowano (NVD) | 2026-06-18 16:16:50 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-06 22:10:00 UTC |
Referencje
- https://github.com/geoserver/geoserver/releases/tag/2.27.0 ([email protected]) [Product, Release Notes]
- https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7 ([email protected]) [Vendor Advisory]
- https://nvd.nist.gov/vuln/detail/cve-2023-27867 ([email protected]) [Not Applicable]
- https://osgeo-org.atlassian.net/browse/GEOT-7725 ([email protected]) [Issue Tracking]