CVE-2025-27511

Katalog CVE

CVSS 7.2 · High EPSS 1,1%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada osgeo geoserver. Skor CVSS 3.1 7.2 (High) menurut github.com.

Deskripsi (NVD)

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

Rincian

Terbit di NVD

18 Juni 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7 advisory vendor
• https://github.com/geoserver/geoserver/releases/tag/2.27.0 product · release notes
• https://nvd.nist.gov/vuln/detail/cve-2023-27867 not applicable
• https://osgeo-org.atlassian.net/browse/GEOT-7725 issue tracking