CVE-2024-40625
GeoServer Coverage REST API Allows Server Side Request Forgery
Summary
GeoServer Coverage REST API Allows Server Side Request Forgery
Original description
The description as published by the source.
GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web osgeo-org.atlassian.net
- web osgeo-org.atlassian.net