diff --git a/http/cves/2024/CVE-2024-36401.yaml b/http/cves/2024/CVE-2024-36401.yaml index eb0361468d..358bd229f9 100644 --- a/http/cves/2024/CVE-2024-36401.yaml +++ b/http/cves/2024/CVE-2024-36401.yaml @@ -2,7 +2,7 @@ id: CVE-2024-36401 info: name: GeoServer RCE in Evaluating Property Name Expressions - author: DhiyaneshDk + author: DhiyaneshDk,ryanborum severity: critical description: | In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.