CVE-2022-24818

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-917

Affected software

No affected versions have been published.

Timeline

Published
Apr 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-248195.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to vCVE-2022-24828.8A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place aCVE-2022-248205.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to vCVE-2022-248218.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/CVE-2022-248227.5Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a modCVE-2022-248235.5Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4CVE-2022-248245.3Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. notCVE-2022-248255.3Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgeCVE-2022-248267.8On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found CVE-2022-248278.1Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: ECVE-2022-248288.8Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can hCVE-2022-248299.8Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require aut
CVE-2022-24818: High severity, CVSS 7.2 | Vulnix