« Volver al listado

CVE-2025-52465

Estado: AnalizadaAlta (7.2)—

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web interface is either disabled or completely removed are not affected since the vulnerability exists in one of the web pages.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto con privilegios administrativos (PR:H) para extraer la contraseña maestra en texto plano mediante manipulación de rutas de archivo en una página web de GeoServer.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Tecnologías afectadas (1)

Osgeo — Geoserver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-52465",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-52465",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-23T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "geoserver",
          "product": "org.geoserver.web:gs-web-app",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.26.4"
            },
            {
              "status": "affected",
              "version": ">= 2.27.0, < 2.27.3"
            }
          ]
        },
        {
          "vendor": "geoserver",
          "product": "org.geoserver.web:gs-web-sec-core",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.26.4"
            },
            {
              "status": "affected",
              "version": ">= 2.27.0, < 2.27.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-18T16:16:52.027",
  "references": [
    {
      "url": "https://github.com/geoserver/geoserver/pull/8584",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://osgeo-org.atlassian.net/browse/GEOS-11852",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild",
      "tags": [
        "Not Applicable"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web interface is either disabled or completely removed are not affected since the vulnerability exists in one of the web pages."
    },
    {
      "lang": "es",
      "value": "GeoServer es un servidor de código abierto que permite a los usuarios compartir y editar datos geoespaciales. Antes de las versiones 2.26.4 y 2.27.3, existe una vulnerabilidad que permite a un administrador autenticado con acceso al sistema de seguridad de GeoServer pasar nombres de archivo arbitrarios a la página web Master Password Dump y crear archivos que contengan la contraseña maestra en texto plano. El nombre de archivo proporcionado debe ser una ruta absoluta al archivo de destino, el archivo de destino no puede existir previamente y todos los directorios padre deben existir previamente. Las versiones 2.26.4 y 2.27.3 contienen una corrección. Las instalaciones de GeoServer donde la interfaz web está deshabilitada o completamente eliminada no se ven afectadas ya que la vulnerabilidad existe en una de las páginas web."
    }
  ],
  "lastModified": "2026-09-30T21:10:00.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "003F5494-D544-4EF9-A951-96A2CBE0C458",
              "versionEndExcluding": "2.26.4"
            },
            {
              "criteria": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E0712B8-BE54-43DF-9CCE-3A65824138C4",
              "versionEndExcluding": "2.27.3",
              "versionStartIncluding": "2.27.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}