CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-40625: GeoServer Coverage REST API Allows Server Side Request Forgery
5.5
CVSS
Description
GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.
Classification
CVE ID: CVE-2024-40625
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
Problem Types
CWE-918: Server-Side Request Forgery (SSRF)Affected Products
Vendor: geoserver
Product: geoserver
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 12.88% (scored less or equal to compared to others)
EPSS Date: 2025-06-19 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: partial
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2024-40625https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2
https://osgeo-org.atlassian.net/browse/GEOS-11468
https://osgeo-org.atlassian.net/browse/GEOS-11717