mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-01-31 15:53:33 +08:00
fix: improve CVE-2025-27505 template
- Enhanced description with better detail and impact - Added missing cve-id field in classification - Updated fofa-query to use lowercase for consistency - Added shodan-query for better discoverability - Added misconfig and osgeo tags for categorization - Quoted string matchers to prevent parsing issues
This commit is contained in:
@@ -4,7 +4,8 @@ info:
|
||||
name: GeoServer - Missing Authorization on REST API Index
|
||||
author: securitytaters
|
||||
severity: medium
|
||||
description: GeoServer has authorization issue on its REST API Index page
|
||||
description: |
|
||||
GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.
|
||||
reference:
|
||||
- http://geoserver.org/
|
||||
- https://geoserver.org/vulnerability/2025/06/10/cve-disclosure.html
|
||||
@@ -12,15 +13,17 @@ info:
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
||||
cvss-score: 5.3
|
||||
cve-id: CVE-2025-27505
|
||||
cwe-id: CWE-862
|
||||
cpe: cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
fofa-query: app="GeoServer"
|
||||
fofa-query: app="geoserver"
|
||||
shodan-query: http.title:"geoserver"
|
||||
vendor: osgeo
|
||||
product: geoserver
|
||||
tags: cve,cve2025,geoserver
|
||||
tags: cve,cve2025,geoserver,misconfig,osgeo
|
||||
|
||||
http:
|
||||
- method: GET
|
||||
@@ -35,12 +38,12 @@ http:
|
||||
- type: word
|
||||
part: body
|
||||
words:
|
||||
- Geoserver Configuration API
|
||||
- "Geoserver Configuration API"
|
||||
|
||||
- type: word
|
||||
part: body
|
||||
words:
|
||||
- about/status
|
||||
- "about/status"
|
||||
|
||||
- type: status
|
||||
status:
|
||||
|
||||
Reference in New Issue
Block a user