PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-36401 OSGeo CVE debrief

CVE-2024-36401 is a CISA Known Exploited Vulnerability affecting OSGeo GeoServer and related GeoTools usage. The supplied official metadata identifies it as an eval injection issue and notes CISA’s guidance to apply vendor mitigations or discontinue use of the product if mitigations are unavailable. CISA added the entry on 2024-07-15 and set a remediation due date of 2024-08-05 in the supplied timeline.

Vendor
OSGeo
Product
GeoServer
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2024-07-15
Original CVE updated
2024-07-15
Advisory published
2024-07-15
Advisory updated
2024-07-15

Who should care

Administrators, security teams, and application owners running OSGeo GeoServer or products that embed or depend on GeoTools should treat this as urgent, especially for internet-facing deployments and shared services.

Technical summary

The public record supplied here describes CVE-2024-36401 as an OSGeo GeoServer GeoTools eval injection vulnerability. The corpus does not provide a CVSS score, full impact details, or validated exploitation mechanics beyond the KEV listing and the vendor-mitigation/discontinue-use guidance referenced by CISA.

Defensive priority

Urgent

Recommended defensive actions

  • Inventory all GeoServer deployments and any downstream products or services that bundle or depend on GeoTools.
  • Review the official vendor guidance and apply the recommended mitigation or update path as soon as possible.
  • If a mitigation is not available for a deployment, discontinue use of the affected product until it can be remediated.
  • Prioritize externally reachable and production instances before less exposed internal systems.
  • Validate exposure after remediation and confirm the affected component is no longer reachable or in use.

Evidence notes

This debrief is based only on the supplied official records and CISA KEV metadata. The KEV entry names the issue 'OSGeo GeoServer OSGeo GeoServer GeoTools Eval Injection Vulnerability' and instructs: 'Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.' The supplied corpus does not include a CVSS score.

Official resources

Publicly disclosed and added to CISA’s Known Exploited Vulnerabilities catalog on 2024-07-15, per the supplied timeline and source metadata.