« Volver al listado

CVE-2025-30220

Estado: AnalizadaCrítica (9.1)—

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XXE en GeoServer expuesto (AV:N, PR:N, UI:N) permite lectura de datos locales (C:H) y DoS (A:H) mediante entidades externas; T1190 por aplicación web vulnerable sin autenticación.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningSSL/TLS InspectionPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over Network

Tecnologías afectadas (3)

Geotools — GeotoolsOsgeo — GeonetworkOsgeo — Geoserver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-30220",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-30220",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-10T17:13:03.887707Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "geoserver",
          "product": "geoserver",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.27.0, < 2.27.1"
            },
            {
              "status": "affected",
              "version": ">= 2.26.0, < 2.26.3"
            },
            {
              "status": "affected",
              "version": "< 2.25.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-10T16:15:37.387",
  "references": [
    {
      "url": "https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8757",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8803",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8812",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13."
    },
    {
      "lang": "es",
      "value": "GeoServer es un servidor de código abierto que permite a los usuarios compartir y editar datos geoespaciales. El uso de la librería XSD de Eclipse por parte de la clase Esquema de GeoTools para representar la estructura de datos del esquema es vulnerable a la vulnerabilidad de Entidad Externa XML (XXE). Esto afecta a quien exponga el procesamiento XML con gt-xsd-core involucrado en el análisis, cuando los documentos contienen una referencia a un esquema XML externo. La clase Esquemas de gt-xsd-core no utiliza el EntityResolver proporcionado por ParserHandler (si se configuró alguno). Esto también afecta a los usuarios del almacén de datos gt-wfs-ng donde el parámetro de conexión ENTITY_RESOLVER no se utilizaba correctamente. Esta vulnerabilidad está corregida en GeoTools 33.1, 32.3, 31.7 y 28.6.1, GeoServer 2.27.1, 2.26.3 y 2.25.7, y GeoNetwork 4.4.8 y 4.2.13."
    }
  ],
  "lastModified": "2026-06-17T09:08:22.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "319F63C7-7B2E-43CB-A91D-536D0D5D66BE",
              "versionEndExcluding": "28.6.1"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26F4D869-28DC-4F07-A122-B93D948EBBCF",
              "versionEndExcluding": "31.7",
              "versionStartIncluding": "29.0"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C145224-639E-45FB-8413-C1570B9F23B6",
              "versionEndExcluding": "32.3",
              "versionStartIncluding": "32.0"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:33.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D95F0CB7-D8DF-44D3-9967-34A73AF85BAE"
            },
            {
              "criteria": "cpe:2.3:a:osgeo:geonetwork:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3595E000-B460-4BA9-AC3E-A8678FBD9899",
              "versionEndExcluding": "4.2.13",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:osgeo:geonetwork:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5B335EE-0493-44DE-A385-141AA2E777E7",
              "versionEndExcluding": "4.4.8",
              "versionStartIncluding": "4.4.0"
            },
            {
              "criteria": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F0B3A06-FC80-4BDD-8E00-1AE8D51A5930",
              "versionEndExcluding": "2.25.7"
            },
            {
              "criteria": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "657234C4-41D0-4CD9-B1DD-BBF565C608C6",
              "versionEndExcluding": "2.26.3",
              "versionStartIncluding": "2.26.0"
            },
            {
              "criteria": "cpe:2.3:a:osgeo:geoserver:2.27.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F80D593-ADBB-46EC-B1DC-F154B6385E22"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}