Login Request a demo
High severity · published Apr 13, 2022
CVE-2022-24818
GeoTools is an open source Java library that provides tools for geospatial data
7.2
CVSS
2.4%
EPSS
No
On KEV
Description
GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geotools · Geotools
before 24.6; 25.0 before 25.6; 26.0 before 26.4 · source: NVD
Affected product
GE
Geotools
Geotools
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24818
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24818
Patch
https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49
Third Party Advisory
https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x
More from Geotools
9.8
CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
9.8
CVE-2026-76904
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
9.8
CVE-2023-25158
GeoTools is an open source Java library that provides tools for geospatial data
9.1
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data