Is CVE-2022-24816 actively exploited?

Yes. CVE-2022-24816 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2022-24816 be exploited remotely?

The attack vector of CVE-2022-24816 has not been classified yet.

What is the CVSS score of CVE-2022-24816?

CVE-2022-24816 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2022-24816

HIGHCISA KEVIN THE WILD

CVE-2022-24816

Published: June 26, 2024

EPSS:94.02%probability of exploitation in 30 daysPercentile:99.9th

Official Description

OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.

NVD Source

CISA KEV Advisory

OSGeo GeoServer JAI-EXT Code Injection Vulnerability

OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.

Added to KEV: 2024-06-26Federal patch deadline: 2024-07-17

Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Risk Analysis

A code injection vulnerability exists in OSGeo GeoServer JAI-EXT when using jt-jiffle and allowing Jiffle scripts via network requests. This can lead to remote code execution. The high EPSS score and confirmed exploitation in the wild highlight the urgency of addressing this vulnerability.

This vulnerability is actively exploited in the wild and is included in CISA's KEV catalog. It is remotely exploitable.

Recommended Action

Update OSGeo GeoServer JAI-EXT to a patched version. Restrict the ability for Jiffle scripts to be provided via network requests if not essential.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2022-24816 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2022-24816 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.