CVE-2022-24816 — OSGeo GeoServer JAI-EXT Code Injection Vulnerability
2024-06-26 • CISA Known Exploited Vulnerability
[event] OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.
> AFFECTED SOFTWARE
| Field | Value |
|---|---|
| Vendor | OSGeo |
| Product | JAI-EXT |
| CWE | CWE-94 |
| CVE ID | CVE-2022-24816 |
| Date Added | 2024-06-26 |
| Due Date | 2024-07-17 |
| Ransomware Campaign | Unknown |
> MITIGATION
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2024-07-17