CVE-2025-58175

Katalog CVE

CVSS 8.2 · High EPSS 0,29%

Kerentanan Improper Input Validation pada osgeo geoserver. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

Rincian

Terbit di NVD

18 Juni 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-611: Improper Restriction of XML External Entity Reference
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww mitigasi · advisory vendor
• https://github.com/geoserver/geoserver/pull/8622 issue tracking · patch
• https://osgeo-org.atlassian.net/browse/GEOS-11867 issue tracking