CVE-2024-23634

Summary

CVE-2024-23634 is a vulnerability affecting the open-source GeoServer software, which allows users to manage geospatial data. An authenticated administrator with permissions can exploit this issue in versions prior to 2.23.5 and 2.24.2 through the REST Coverage Store or Data Store API. They can rename arbitrary files and directories without the required .zip extension, allowing for potential denial-of-service attacks. Renaming GeoServer files may result in preventing the software from running or deleting specific resources. In some instances, this could revert to default settings, potentially allowing unintended OGC requests. The impact on non-GeoServer files is dependent on the specific environment, but denial-of-service is a likely outcome. Versions 2.23.5 and 2.24.2 have resolved this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.