CVE-2022-24816

geosolutionsgroup jai-ext

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-24816

Katalog CVE

CVSS 10.0 · Critical KEV · sudah dieksploitasi EPSS 99,9%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada geosolutionsgroup jai-ext. Skor CVSS 3.1 10.0 (Critical) menurut NVD. Masuk katalog KEV CISA pada 26 Juni 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

Rincian

Terbit di NVD
13 April 2022
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari)
99,9% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama
OSGeo GeoServer JAI-EXT Code Injection Vulnerability
Masuk KEV
26 Juni 2024
Tenggat CISA
17 Juli 2024 (untuk instansi federal AS)
Ransomware
Belum tercatat
Tindakan wajib
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

VendorProdukVersi terdampak
geosolutionsgroup jai-ext Semua versi sebelum 1.1.22

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.