CVE-2023-51444
CVSS 3.1 Score 7.2 of 10 (high)
Details
Summary
CVE-2023-51444 is a vulnerability affecting GeoServer, an open-source Java software for managing and sharing geospatial data. This issue allows authenticated administrators with permissions to modify coverage stores using the REST Coverage Store API. The flaw enables the uploading of arbitrary file contents to arbitrary file locations, potentially leading to remote code execution. The risk is heightened for coverage stores configured with absolute paths, as they use a Resource implementation without adequate path validation. An attacker could exploit this vulnerability to execute arbitrary code or even obtain full administrator privileges, even if the targeted administrator has limited access. Versions 2.23.4 and 2.24.1 of GeoServer include a fix for this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions