PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-36401 OSGeo CVE debrief

CVE-2024-36401 is a CISA Known Exploited Vulnerability affecting OSGeo GeoServer and related GeoTools usage. The supplied official metadata identifies it as an eval injection issue and notes CISA’s guidance to apply vendor mitigations or discontinue use of the product if mitigations are unavailable. CISA added the entry on 2024-07-15 and set a remediation due date of 2024-08-05 in the supplied timeline.

Vendor
OSGeo
Product
GeoServer
CVSS
CRITICAL 9.8
CISA KEV
Listed
Original CVE published
2024-07-15
Original CVE updated
2024-07-15
Advisory published
2024-07-15
Advisory updated
2024-07-15

Who should care

Administrators, security teams, and application owners running OSGeo GeoServer or products that embed or depend on GeoTools should treat this as urgent, especially for internet-facing deployments and shared services.

Technical summary

The public record supplied here describes CVE-2024-36401 as an OSGeo GeoServer GeoTools eval injection vulnerability. The corpus does not provide a CVSS score, full impact details, or validated exploitation mechanics beyond the KEV listing and the vendor-mitigation/discontinue-use guidance referenced by CISA.

Defensive priority

Urgent

Recommended defensive actions

  • Inventory all GeoServer deployments and any downstream products or services that bundle or depend on GeoTools.
  • Review the official vendor guidance and apply the recommended mitigation or update path as soon as possible.
  • If a mitigation is not available for a deployment, discontinue use of the affected product until it can be remediated.
  • Prioritize externally reachable and production instances before less exposed internal systems.
  • Validate exposure after remediation and confirm the affected component is no longer reachable or in use.

Evidence notes

This debrief is based only on the supplied official records and CISA KEV metadata. The KEV entry names the issue 'OSGeo GeoServer OSGeo GeoServer GeoTools Eval Injection Vulnerability' and instructs: 'Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.' The supplied corpus does not include a CVSS score.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-36401 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-36401

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-36401 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36401

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.