CVE-2024-36401—OSGeo GeoServer GeoTools Eval Injection Vulnerability

漏洞名称

OSGeo GeoServer GeoTools Eval Injection Vulnerability

描述

OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.

已知用于勒索软件活动吗？

勒索软件状态：

Unknown

采集行动

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

其他说明

• This vulnerability affects an open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv, https://github.com/geotools/geotools/pull/4797
• https://nvd.nist.gov/vuln/detail/CVE-2024-36401

相关新闻文章

• GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal BackendsSeptember 2, 2026
• GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCEAugust 13, 2026
• New SharkLoader Malware Deploys Cobalt Strike in StrikeShark CyberattacksJune 26, 2026
• CISA says hackers breached federal agency using GeoServer exploitSeptember 23, 2025
• GeoServer Exploits, PolarEdge, and Gayfemboy Push Cybercrime Beyond Traditional BotnetsAugust 23, 2025

相关 CWE

• CWE-95