« Volver al listado

CVE-2025-58175

Estado: AnalizadaAlta (8.2)—

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota sin autenticación en GeoServer (AV:N, PR:N, UI:N) que permite SSRF mediante XML malformado. El SSRF permite acceso a recursos internos (T1090) y potencial lectura de datos (T1005). CWE-918 confirma SSRF.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningSSL/TLS InspectionPrivileged Account ManagementNetwork SegmentationNetwork Intrusion Prevention

Tecnologías afectadas (1)

Osgeo — Geoserver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-58175",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-58175",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-18T15:25:52.864367Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "geoserver",
          "product": "org.geoserver.web:gs-web-app",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.26.4"
            },
            {
              "status": "affected",
              "version": ">= 2.27.0, < 2.27.3"
            }
          ]
        },
        {
          "vendor": "geoserver",
          "product": "org.geoserver:gs-main",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.26.4"
            },
            {
              "status": "affected",
              "version": ">= 2.27.0, < 2.27.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-18T16:16:52.173",
  "references": [
    {
      "url": "https://github.com/geoserver/geoserver/pull/8622",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://osgeo-org.atlassian.net/browse/GEOS-11867",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-611"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability."
    },
    {
      "lang": "es",
      "value": "GeoServer es un servidor de código abierto que permite a los usuarios compartir y editar datos geoespaciales. Antes de las versiones 2.26.4 y 2.27.3, un GeoServer que utiliza 'ENTITY_RESOLUTION_ALLOWLIST' puede permitir al atacante realizar una falsificación de petición del lado del servidor (SSRF) no autenticada. Esta vulnerabilidad requiere que GeoServer esté configurado para usar una URL base de proxy y la 'ENTITY_RESOLUTION_ALLOWLIST' (predeterminada desde la 2.25.0). Las versiones 2.26.4 y 2.27.3 contienen una corrección. Las instalaciones de GeoServer solo se ven afectadas por esta vulnerabilidad si utilizan una URL base de proxy que no contiene una ruta de URL o no termina con una barra. Si la URL base de proxy no contiene una ruta, añadir una barra al final de la URL mitigará esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-09-30T21:10:00.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "003F5494-D544-4EF9-A951-96A2CBE0C458",
              "versionEndExcluding": "2.26.4"
            },
            {
              "criteria": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E0712B8-BE54-43DF-9CCE-3A65824138C4",
              "versionEndExcluding": "2.27.3",
              "versionStartIncluding": "2.27.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}