The version of OSGeo GeoServer installed on the remote host is affected by a remote code executionvulnerability, as follows: Multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version…Read More