5.3 - CVE-2023-41339

Executive Summary

Informations
Name	CVE-2023-41339	First vendor Publication	2023-10-25
Vendor	Cve	Last vendor Modification	2023-10-31

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Overall CVSS Score	5.3
Base Score	5.3	Environmental Score	5.3
impact SubScore	1.4	Temporal Score	5.3
Exploitabality Sub Score	3.9

Attack Vector	Network	Attack Complexity	Low
Privileges Required	None	User Interaction	None
Scope	Unchanged	Confidentiality Impact	Low
Integrity Impact	None	Availability Impact	None
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an ``sld=`` parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. This vulnerability can be used to steal user NetNTLMv2 hashes which could be relayed or cracked externally to gain further access. This vulnerability has been patched in versions 2.22.5 and 2.23.2.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41339

CPE : Common Platform Enumeration

Type	Description	Count
Application	Osgeo Geoserver cpe:2.3:a:osgeo:geoserver::::::::	1

Sources (Detail)

Source	Url
MISC	https://github.com/geoserver/geoserver/releases/tag/2.22.5 https://github.com/geoserver/geoserver/releases/tag/2.23.2 https://github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmf