Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2023-41877— GeoServer log file path traversal vulnerability

CVSS 7.2 · High EPSS 1.22% · P79
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2023-41877

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GeoServer log file path traversal vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location to an arbitrary location. The admin console GeoServer Logs page provides a preview of these contents. As this issue requires GeoServer administrators access, often representing a trusted party, the vulnerability has not received a patch as of time of publication. As a workaround, a system administrator responsible for running GeoServer can use the `GEOSERVER_LOG_FILE` setting to override any configuration option provided by the Global Settings page. The `GEOSERVER_LOG_LOCATION` parameter can be set as system property, environment variables, or servlet context parameters.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
GeoServer 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GeoServer是一个用 Java 编写的开源软件服务器。允许用户共享和编辑地理空间数据。 GeoServer 2.23.4 及之前版本存在路径遍历漏洞，该漏洞源于管理员将日志文件错误配置，导致GeoServer日志文件存在路径遍历漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
geoservergeoserver <= 2.23.4 -

II. Public POCs for CVE-2023-41877

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-41877

请登录查看更多情报信息。

Same Patch Batch · geoserver · 2024-03-20 · 10 CVEs total

CVE-2023-514447.2 HIGHGeoServer arbitrary file upload vulnerability in REST Coverage Store API
CVE-2024-236346.0 MEDIUMGeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API
CVE-2023-514454.8 MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API
CVE-2024-236404.8 MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher
CVE-2024-236424.8 MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer
CVE-2024-236434.8 MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form
CVE-2024-238184.8 MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format
CVE-2024-238214.8 MEDIUMGeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)
CVE-2024-238194.8 MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page

IV. Related Vulnerabilities

Same product: geoserver
Same vendor: geoserver
Same weakness: CWE-22

V. Comments for CVE-2023-41877

No comments yet

Leave a comment