VulnerabilitycriticalExploited in the wild

GeoServer Vulnerability Targeted by Hackers to Deliver Backdoors and Botnet Malware

The Hacker Newsby @TheHackersNewsSep 8, 2024 · 07:56 UTC (Sep 8, 2024)2 min read

Read at thehackernews.com

Analyze CVE-2024-36401 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2024-36401 CVE-2021-20123 CVE-2021-20124

Tags: cve-2024-36401 cve-2021-20123 cve-2021-20124 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-20124 +1 related CVE CVE-2021-20123	Unauthenticated Path Traversal File Download in DrayTek VigorConnect	7.5	96%	KEVPoC	Oct 13, 2021 KEV Sep 3, 2024
CVE-2024-36401	Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection	9.8	100%	KEVPoC ×3	Jul 1, 2024 KEV Jul 15, 2024

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Sep 06, 2024 Cryptocurrency / APT Attack A recently disclosed security flaw in OSGeo GeoServer GeoTools has been exploited as part of multiple campaigns to deliver cryptocurrency miners, botnet malware such as Condi and JenX, and a known backdoor called SideWalk. The security vulnerability is a critical remote code execution bug (CVE-2024-36401, CVSS score: 9.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.