EXPOSURES › CVE-2022-24816

CVE-2022-24816

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2024-06-26 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2022-24816 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 45/100 rceexploited-in-wildunpatched

OSGeo GeoServer JAI-EXT allows remote code execution via network-provided Jiffle scripts.

The JAI-EXT component in OSGeo GeoServer permits attackers to inject arbitrary Jiffle scripts through network requests, enabling remote code execution. DIB organizations must patch immediately to prevent unauthorized code execution in government systems.

Shame score — A known RCE vulnerability in a widely used open-source component that was actively exploited but not yet patched in many deployments.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

OSGeo · vendor JAI-EXT · product

DESCRIPTION

OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.