GHSA-68cf-j696-wvv9

Source

https://github.com/advisories/GHSA-68cf-j696-wvv9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-68cf-j696-wvv9/GHSA-68cf-j696-wvv9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-68cf-j696-wvv9

Published

2025-06-10T20:17:58Z

Modified

2025-06-10T20:17:58Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx

Details

Summary

Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint.

Mitigation

To manage the proxy base value as a system administrator, use the parameter PROXY_BASE_URL to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith.

Resolution

The TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript Demo Requests page to test OGC Web Services.

References

CVE-2024-29198 Unauthenticated SSRF via TestWfsPost

Database specific

{
    "github_reviewed_at": "2025-06-10T20:17:58Z",
    "cwe_ids": [
        "CWE-918"
    ],
    "nvd_published_at": null,
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

Maven / org.geoserver:gs-wfs

Package

Name: org.geoserver:gs-wfs; View open source insights on deps.dev
Purl: pkg:maven/org.geoserver/gs-wfs

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Fixed

2.24.4

Maven / org.geoserver:gs-wfs

Package

Name: org.geoserver:gs-wfs; View open source insights on deps.dev
Purl: pkg:maven/org.geoserver/gs-wfs

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.25.0

Fixed

2.25.2