CyberzSOC

These vulnerabilities can result in arbitrary code execution through the unsafe evaluation of user-supplied XPath expressions [1,2,3]. The vulnerability CVE-2024-36401, with a CVSS score of 9.8, allows Remote Code Execution (RCE) flaw by unauthenticated users via specially crafted input to a default GeoServer installation. This issue arises from the unsafe evaluation of property names as XPath expressions due to a flaw in the GeoTools library API, which GeoServer relies upon [1]. The vulnerability CVE-2024-36404, with a CVSS score of 9.8, is a Remote Code Execution (RCE) flaw against the GeoTools library. This vulnerability occurs when certain methods use the commons-jxpath library to evaluate XPath expressions supplied within user inputs. The commons-jxpath library has the capability to execute arbitrary code embedded within these CVE-2024-36401 affects the following packages CVE-2024-36404 affects the following packages CERT-EU strongly recommends updating to the latest versions by following the instructions GeoServer has issued a workaround and mitigation measures depending on the release version.