CVE-2022-24846

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. While in GeoWebCache the JNDI strings are provided via local configuration file, in GeoServer a user interface is provided to perform the same, that can be accessed remotely, and requires admin-level login to be used. These lookup are unrestricted in scope and can lead to code execution. The lookups are going to be restricted in GeoWebCache 1.21.0, 1.20.2, 1.19.3.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Apr 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248477.2GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mech CVE-2022-248488.8DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability CVE-2022-248496.5DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have CVE-2022-24857.5Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its pass CVE-2022-248504.3Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has acce CVE-2022-248514.8LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an e CVE-2022-248535.3Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as par CVE-2022-248548.8Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which a CVE-2022-248555.4Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development CVE-2022-248567.5FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request for CVE-2022-248578.8django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular CVE-2022-248586.1next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2