CVE-2023-51444

Summary

CVE-2023-51444 is a vulnerability affecting GeoServer, an open-source Java software for managing and sharing geospatial data. This issue allows authenticated administrators with permissions to modify coverage stores using the REST Coverage Store API. The flaw enables the uploading of arbitrary file contents to arbitrary file locations, potentially leading to remote code execution. The risk is heightened for coverage stores configured with absolute paths, as they use a Resource implementation without adequate path validation. An attacker could exploit this vulnerability to execute arbitrary code or even obtain full administrator privileges, even if the targeted administrator has limited access. Versions 2.23.4 and 2.24.1 of GeoServer include a fix for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.