CVE-2022-24846

Unchecked JNDI lookups in GeoWebCache

Description

GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. While in GeoWebCache the JNDI strings are provided via local configuration file, in GeoServer a user interface is provided to perform the same, that can be accessed remotely, and requires admin-level login to be used. These lookup are unrestricted in scope and can lead to code execution. The lookups are going to be restricted in GeoWebCache 1.21.0, 1.20.2, 1.19.3.

Categories

9.1
CVSS
Severity: Critical
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.43%
Third-Party Advisory github.com
Affected: GeoWebCache geowebcache
Published at:
Updated at:

References

Link Tags
https://github.com/GeoWebCache/geowebcache/security/advisories/GHSA-4v22-v8jp-438r third party advisory

Frequently Asked Questions

What is the severity of CVE-2022-24846?
CVE-2022-24846 has been scored as a critical severity vulnerability.
How to fix CVE-2022-24846?
To fix CVE-2022-24846, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-24846 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-24846 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-24846?
CVE-2022-24846 affects GeoWebCache geowebcache.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.