{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13."
    },
    {
      "lang": "es",
      "value": "GeoServer es un servidor de c\u00f3digo abierto que permite a los usuarios compartir y editar datos geoespaciales. El uso de la librer\u00eda XSD de Eclipse por parte de la clase Esquema de GeoTools para representar la estructura de datos del esquema es vulnerable a la vulnerabilidad de Entidad Externa XML (XXE). Esto afecta a quien exponga el procesamiento XML con gt-xsd-core involucrado en el an\u00e1lisis, cuando los documentos contienen una referencia a un esquema XML externo. La clase Esquemas de gt-xsd-core no utiliza el EntityResolver proporcionado por ParserHandler (si se configur\u00f3 alguno). Esto tambi\u00e9n afecta a los usuarios del almac\u00e9n de datos gt-wfs-ng donde el par\u00e1metro de conexi\u00f3n ENTITY_RESOLVER no se utilizaba correctamente. Esta vulnerabilidad est\u00e1 corregida en GeoTools 33.1, 32.3, 31.7 y 28.6.1, GeoServer 2.27.1, 2.26.3 y 2.25.7, y GeoNetwork 4.4.8 y 4.2.13."
    }
  ],
  "id": "CVE-2025-30220",
  "lastModified": "2025-06-12T16:06:39.330",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.3,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-06-10T16:15:37.387",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8757"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8803"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8812"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver.web:gs-web-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.27.0"
            },
            {
              "fixed": "2.27.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.27.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver:gs-wfs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.27.0"
            },
            {
              "fixed": "2.27.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.27.0"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.26.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver.web:gs-web-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.26.0"
            },
            {
              "fixed": "2.26.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.26.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver:gs-wfs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.26.0"
            },
            {
              "fixed": "2.26.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.25.6"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver.web:gs-web-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.25.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.25.6"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver:gs-wfs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.25.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-30220"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-10T20:10:06Z",
    "nvd_published_at": "2025-06-10T16:15:37Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nGeoServer Web Feature Service (WFS) web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity (XXE) processing attack.\n\nIt is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers.  This allows for Out-of-Band (OOB) data exfiltration of local files accessible by the GeoServer process, and Service Side Request Forgery (SSRF).\n\n## Details\n\nWhile direct entity resolution is managed by application property ENTITY_RESOLUTION_ALLOWLIST for XML Parsing, this restriction was not being used by the GeoTools library when building an in-memory XSD Library Schema representation.\n\nThis bypasses GeoServer\u0027s AllowListEntityResolver enabling XXE attacks.\n\n## PoC\n\nNo public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS service.\n\n## Impact\n\n* Information Disclosure: \n\n  This vulnerability allows unauthenticated attackers to read arbitrary files from the server\u0027s filesystem that are accessible to the GeoServer process.\n  \n  This can lead to exposure of sensitive information including configuration files, credentials, and system files. The attack can be performed remotely without authentication, making it particularly severe.\n\n* Server-Side Request Forgery (SSRF) \n  \n  The mechanism inherently allows forcing GeoServer to make HTTP requests to arbitrary URLs, enabling SSRF attacks against internal network resources \n\n## References\n\n* [CVE-2025-30220](https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw) XML External Entity (XXE) Processing Vulnerability in XSD schema handling\n* [External Entities Resolution](https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities) (GeoServer User Manual)\n\n## Acknowledgements\n\nThis vulnerability was initially reported via an automated tool described below. Subsequently a duplicate report via @YacineF, and their patience working with the GeoServer project, was instrumental finding in escalating this issue and determining a resolution.\n\n### XBOW-025-068 Disclaimer\n\nThis vulnerability was detected using **[XBOW](https://xbow.com/)**, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.",
  "id": "GHSA-jj54-8f66-c5pc",
  "modified": "2025-06-10T20:10:07Z",
  "published": "2025-06-10T20:10:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30220"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8757"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8803"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/8812"
    },
    {
      "type": "WEB",
      "url": "https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geoserver/geoserver"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service"
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "De ontwikkelaars van GeoServer hebben een kwetsbaarheid verholpen in GeoServer \u003c 2.27.0, \u003c 2.26.2, \u003c 2.25.6, GeoTools \u003c 33.0, \u003c 32.2, \u003c 31.6, \u003c 28.6.0 en GeoNetwork \u003c 4.4.7, \u003c 4..2.12.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid bevindt zich in de Eclipse XSD library. De kwetsbaarheid stelt ongeauthenticeerde aanvallers in staat om mogelijke code executie en toegang tot gevoelige bestanden via het injecteren van XML code.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "GeoServer heeft updates een mitigerende maatregelen uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Restriction of XML External Entity Reference",
        "title": "CWE-611"
      },
      {
        "category": "general",
        "text": "Server-Side Request Forgery (SSRF)",
        "title": "CWE-918"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30220"
      },
      {
        "category": "external",
        "summary": "Source raw - nvd",
        "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-30220"
      },
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; github; nvd",
        "url": "https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw"
      }
    ],
    "title": "Kwetsbaarheid verholpen in GeoServer",
    "tracking": {
      "current_release_date": "2025-06-18T10:17:42.472544Z",
      "generator": {
        "date": "2025-06-05T14:45:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.1"
        }
      },
      "id": "NCSC-2025-0197",
      "initial_release_date": "2025-06-18T10:17:42.472544Z",
      "revision_history": [
        {
          "date": "2025-06-18T10:17:42.472544Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/2.26.2",
                "product": {
                  "name": "vers:unknown/2.26.2",
                  "product_id": "CSAFPID-2905970"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c2.25.6",
                "product": {
                  "name": "vers:unknown/\u003c2.25.6",
                  "product_id": "CSAFPID-2906135"
                }
              }
            ],
            "category": "product_name",
            "name": "GeoServer"
          }
        ],
        "category": "vendor",
        "name": "GeoServer"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-788216",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "GeoTools"
          }
        ],
        "category": "vendor",
        "name": "GeoTools"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-30220",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2905970",
          "CSAFPID-2906135",
          "CSAFPID-788216"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-30220 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-30220.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2905970",
            "CSAFPID-2906135",
            "CSAFPID-788216"
          ]
        }
      ],
      "title": "CVE-2025-30220"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "GeoServer ist ein Open-Source-Server zum Teilen von Geodaten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GeoServer ausnutzen, um Informationen offenzulegen oder einen Denial-of-Service auszul\u00f6sen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-1294 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1294.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-1294 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1294"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-5gw5-jccf-6hxw vom 2025-06-10",
        "url": "https://github.com/advisories/GHSA-5gw5-jccf-6hxw"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-gr67-pwcv-76gf vom 2025-06-10",
        "url": "https://github.com/advisories/GHSA-gr67-pwcv-76gf"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-jj54-8f66-c5pc vom 2025-06-10",
        "url": "https://github.com/advisories/GHSA-jj54-8f66-c5pc"
      }
    ],
    "source_lang": "en-US",
    "title": "GeoServer: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-06-10T22:00:00.000+00:00",
      "generator": {
        "date": "2025-06-11T09:17:47.921+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.12"
        }
      },
      "id": "WID-SEC-W-2025-1294",
      "initial_release_date": "2025-06-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-06-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.24.4",
                "product": {
                  "name": "Open Source GeoServer \u003c2.24.4",
                  "product_id": "T044531"
                }
              },
              {
                "category": "product_version",
                "name": "2.24.4",
                "product": {
                  "name": "Open Source GeoServer 2.24.4",
                  "product_id": "T044531-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:geoserver:geoserver:2.24.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2.25.2",
                "product": {
                  "name": "Open Source GeoServer \u003c2.25.2",
                  "product_id": "T044532"
                }
              },
              {
                "category": "product_version",
                "name": "2.25.2",
                "product": {
                  "name": "Open Source GeoServer 2.25.2",
                  "product_id": "T044532-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:geoserver:geoserver:2.25.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2.26.3",
                "product": {
                  "name": "Open Source GeoServer \u003c2.26.3",
                  "product_id": "T044533"
                }
              },
              {
                "category": "product_version",
                "name": "2.26.3",
                "product": {
                  "name": "Open Source GeoServer 2.26.3",
                  "product_id": "T044533-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:geoserver:geoserver:2.26.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2.25.7",
                "product": {
                  "name": "Open Source GeoServer \u003c2.25.7",
                  "product_id": "T044534"
                }
              },
              {
                "category": "product_version",
                "name": "2.25.7",
                "product": {
                  "name": "Open Source GeoServer 2.25.7",
                  "product_id": "T044534-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:geoserver:geoserver:2.25.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2.27.1",
                "product": {
                  "name": "Open Source GeoServer \u003c2.27.1",
                  "product_id": "T044535"
                }
              },
              {
                "category": "product_version",
                "name": "2.27.1",
                "product": {
                  "name": "Open Source GeoServer 2.27.1",
                  "product_id": "T044535-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:geoserver:geoserver:2.27.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "GeoServer"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-29198",
      "product_status": {
        "known_affected": [
          "T044532",
          "T044531"
        ]
      },
      "release_date": "2025-06-10T22:00:00.000+00:00",
      "title": "CVE-2024-29198"
    },
    {
      "cve": "CVE-2025-30145",
      "product_status": {
        "known_affected": [
          "T044533",
          "T044534"
        ]
      },
      "release_date": "2025-06-10T22:00:00.000+00:00",
      "title": "CVE-2025-30145"
    },
    {
      "cve": "CVE-2025-30220",
      "product_status": {
        "known_affected": [
          "T044533",
          "T044535",
          "T044534"
        ]
      },
      "release_date": "2025-06-10T22:00:00.000+00:00",
      "title": "CVE-2025-30220"
    }
  ]
}