What’s Vulnerable › Vulnerabilities

CVE-2023-35042

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 44.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-12 · updated 2026-06-17

Description

GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.

Affected products

• geoserver: from 2.0.0

References

• https://docs.geoserver.org/stable/en/user/services/wps/operations.html#execute
• https://isc.sans.edu/diary/29936
• https://docs.geoserver.org/stable/en/user/services/wps/operations.html#execute
• https://isc.sans.edu/diary/29936

Get alerted when CVE-2023-35042 or the next vulnerability affects your stack