CVE-2023-5786 json
GeoServer GeoWebCache rest.html direct request
published 2023-10-26 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58069
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243592.
Patch / fix
- geoserver geowebcache 1.15.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Qxyday/GeoServe---unauthorized referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- GeoServer GeoWebCache
Classification
- Weakness
-
- CWE-425 Direct Request
References
-
github.com
/Qxyday/GeoServe---unauthorized
exploit, third-party-advisory
-
vuldb.com
/?id.243592
vdb-entry, third-party-advisory
-
vuldb.com
/?ctiid.243592
signature, permissions-required, third-party-advisory
Sources
- CVE List CVE-2023-5786
- NVD CVE-2023-5786
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.