VulertSecurity VulertSecurity

CVE-2023-25157: GeoServer OGC Filter SQL Injection Vulnerabilities

org.geoserver.community:gs-jdbcconfig Updated 02 Oct 2025

Summary

22/02/2023
CVE-2023-25157
Yes i
Critical
9.8

CVE-2023-25157: GeoServer OGC Filter SQL Injection Vulnerabilities. Affects org.geoserver.community:gs-jdbcconfig across 2 version ranges.

< 2.21.4 >= 2.22.0, < 2.22.2

Fixed in 2.21.4 or 2.22.2, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats
SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml
Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile
Javascript package-lock.json · yarn.lock · pnpm-lock.yaml
PHP composer.lock
Python poetry.lock · requirements.txt · Pipfile.lock
Go go.mod
Rust Cargo.lock
Ruby Gemfile.lock
Dart pubspec.lock
C/C++ conan.lock
Elixir mix.lock
Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

A free account is created for continuous monitoring. By scanning, you agree to our Terms & Conditions.

Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

Background

GeoServer is an open-source server for sharing geospatial data. It supports various protocols such as Web Feature Service (WFS), Web Map Service (WMS), and Web Coverage Service (WCS). The OGC Filter expression language and the OGC Common Query Language (CQL) are used in these protocols. GeoServer is vulnerable to SQL Injection attacks when certain filters and functions are used with different data stores.

Vulnerability Detail

The identified SQL Injection vulnerabilities in GeoServer include:

  • SQL Injection in the PropertyIsLike filter when used with a String field and any database DataStore or with a PostGIS DataStore with encode functions enabled.
  • SQL Injection in the strEndsWith function when used with a PostGIS DataStore with encode functions enabled.
  • SQL Injection in the strStartsWith function when used with a PostGIS DataStore with encode functions enabled.
  • SQL Injection in the FeatureId filter when used with any database table having a String primary key column and when prepared statements are disabled.
  • SQL Injection in the jsonArrayContains function when used with a String or JSON field and with a PostGIS or Oracle DataStore (GeoServer 2.22.0+ only).
  • SQL Injection in the DWithin filter when used with an Oracle DataStore.

These vulnerabilities can lead to unauthorized access, data manipulation, and potentially complete compromise of the GeoServer instance.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

  • < 2.21.4 2.21.4
  • >= 2.22.0, < 2.22.2 2.22.2

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There are two workarounds suggested:

  1. Disabling the PostGIS Datastore 'encode functions' setting can mitigate the vulnerabilities related to strEndsWith and strStartsWith functions.
  2. Enabling the PostGIS DataStore 'preparedStatements' setting can mitigate the vulnerability related to the FeatureId filter.

Conclusion

GeoServer is vulnerable to SQL Injection attacks in certain filters and functions. It is crucial to update to the patched versions mentioned in the 'how_to_fix' section to mitigate these vulnerabilities and ensure the security of the GeoServer instance. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for org.geoserver.community:gs-jdbcconfig →

Share this vulnerability

FAQ

What is GeoServer?

GeoServer is an open-source server for sharing geospatial data. It supports various protocols and provides a platform for publishing and managing geospatial data.

The impacted versions of GeoServer include 2.21.4, 2.22.2, 2.20.7, 2.19.7, and 2.18.7. It is recommended to update to the patched versions mentioned in the 'how_to_fix' section.

These vulnerabilities can allow attackers to perform SQL Injection attacks, leading to unauthorized access, data manipulation, and potential compromise of the GeoServer instance.

Yes, there are two workarounds suggested:

  1. Disabling the PostGIS Datastore 'encode functions' setting.
  2. Enabling the PostGIS DataStore 'preparedStatements' setting.

You can find more information about these vulnerabilities in the references provided in the vulnerability details section.

References

View More
Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

  • < 2.21.4 2.21.4
  • >= 2.22.0, < 2.22.2 2.22.2

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →
Help improve this record
Report an issue or send feedback