What is CVE-2023-25157?

CVE-2023-25157 is a critical-severity vulnerability in Geoserver, classified under SQL Injection. CVSS score: 9.8/10. Published 2023-02-21.

How severe is CVE-2023-25157?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2023-25157 known to be exploited?

37 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Geoserver

CVE-2023-25157

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web F…

Vulnerability class: SQL Injection

EPSS: 0.941 (99.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Geoserver — versions >= 2.22.0, < 2.22.2, < 2.21.4

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

References

https://github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccf (x_refsource_CONFIRM)
https://github.com/geoserver/geoserver/commit/145a8af798590288d270b240235e89c8f0b62e1d (x_refsource_MISC)

Frequently asked questions

What is CVE-2023-25157?: CVE-2023-25157 is a critical-severity vulnerability in Geoserver, classified under SQL Injection. CVSS score: 9.8/10. Published 2023-02-21.
How severe is CVE-2023-25157?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2023-25157 known to be exploited?: 37 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.