GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.
Metrics
Affected Vendors & Products
References
History
Wed, 27 Nov 2024 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2023-06-12T00:00:00
Updated: 2024-11-27T15:06:46.791Z
Reserved: 2023-06-12T00:00:00
Link: CVE-2023-35042
Vulnrichment
Updated: 2024-08-02T16:17:04.308Z
NVD
Status : Modified
Published: 2023-06-12T15:15:09.820
Modified: 2024-11-21T08:07:52.300
Link: CVE-2023-35042
Redhat
No data.