Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
[EXPLOIT] CVE-2023-25157 [CRITICAL/PoC] CVE-2023-25157 🔗 https://exploitgrid.net/exploits/705ea0f5-d402-4a48-a874-fc18abaaafd7
Post summary
A Proof of Concept for CVE-2023-25157 is posted with a link to ExploitGrid, but no collapse details, patch information, or evidence of active exploitation are provided.
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2018-20062 CVE-2023-25157 CVE-2024-4577 CVE-2026-20253 CVE-2026-41096 ..🧵👇
Post summary
The tweet announces a list of newly disclosed critical CVEs without offering additional details, tools, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | osgeo | geoserver | - | - | - |