Detections
Analytics
GeoServer 2.24.0 < 2.24.2 Path Traversal
medium Web App Scanning Plugin ID 114533
Language:
Synopsis
GeoServer 2.24.0 < 2.24.2 Path TraversalDescription
According to its banner, the version of GeoServer running on the remote host is prior to 2.23.5 or 2.24.0 prior to 2.24.2. It is, therefore, affected by an Arbitrary File Renaming.Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to GeoServer version 2.24.2 or later.See Also
https://github.com/geoserver/geoserver/security/advisories/GHSA-75m5-hh4r-q9gx
Plugin Details
Severity: Medium
ID: 114533
Type: remote
Family: Component Vulnerability
Published: 12/10/2024
Updated: 12/10/2024
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 5.5
CVSS v2
Risk Factor: High
Base Score: 7.3
Vector: CVSS2#AV:N/AC:L/Au:M/C:P/I:P/A:C
CVSS Score Source: CVE-2024-23634
CVSS v3
Risk Factor: Medium
Base Score: 6
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
CVSS Score Source: CVE-2024-23634
Vulnerability Information
CPE: cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
Exploit Ease: No known exploits are available
Patch Publication Date: 3/19/2024
Vulnerability Publication Date: 3/19/2024
Reference Information
CVE: CVE-2024-23634
OWASP: 2010-A4, 2013-A4, 2013-A9, 2017-A5, 2017-A9, 2021-A3, 2021-A4, 2021-A6
WASC: Improper Input Handling
CAPEC: 10, 101, 104, 108, 109, 110, 120, 13, 135, 136, 14, 153, 182, 209, 22, 23, 230, 231, 24, 250, 261, 267, 28, 3, 31, 42, 43, 45, 46, 47, 473, 52, 53, 588, 63, 64, 67, 7, 71, 72, 73, 76, 78, 79, 8, 80, 81, 83, 85, 88, 9
DISA STIG: APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2)
ISO: 27001-A.14.2.5
NIST: sp800_53-CM-6b, sp800_53-SI-10
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-12.3.2, 4.0.2-14.2.1, 4.0.2-5.1.3