Read the docs
TI-2008-06915 Aliases CVE-2008-7227

PartialBufferOutputStream2 in GeoServer before 1.6.1 and 1.7.0-beta1 attempts to flush…

Priority LOW 25CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

PartialBufferOutputStream2 in GeoServer before 1.6.1 and 1.7.0-beta1 attempts to flush buffer contents even when it is handling an "in memory buffer," which prevents the reporting of a service exception, with unknown impact and attack vectors.

Why it matters now

EPSS 0.00926 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:geoserver:geoserver:*:beta4:*:*:*:*:*:*up to 1.6.0Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.3.0:*:*:*:*:*:*:*1.3.0Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.3.0:beta:*:*:*:*:*:*1.3.0 betaVulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.3.0:pr1:*:*:*:*:*:*1.3.0 pr1Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.3.0:rc2:*:*:*:*:*:*1.3.0 rc2Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.3.0:rc4:*:*:*:*:*:*1.3.0 rc4Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.3.0:rc6:*:*:*:*:*:*1.3.0 rc6Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.3.0:rc7:*:*:*:*:*:*1.3.0 rc7Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.3.2:*:*:*:*:*:*:*1.3.2Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.4.0:m0:*:*:*:*:*:*1.4.0 m0Vulnerablegeoserver
  • cpe:2.3:a:geoserver:geoserver:*:beta4:*:*:*:*:*:* Versions up to 1.6.0 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.3.0:beta:*:*:*:*:*:* Versions 1.3.0 beta Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.3.0:pr1:*:*:*:*:*:* Versions 1.3.0 pr1 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.3.0:rc2:*:*:*:*:*:* Versions 1.3.0 rc2 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.3.0:rc4:*:*:*:*:*:* Versions 1.3.0 rc4 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.3.0:rc6:*:*:*:*:*:* Versions 1.3.0 rc6 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.3.0:rc7:*:*:*:*:*:* Versions 1.3.0 rc7 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.4.0:m0:*:*:*:*:*:* Versions 1.4.0 m0 Vulnerable ·geoserver
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:geoserver:geoserver:1.4.0:m1:*:*:*:*:*:*1.4.0 m1Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.5.0:beta2:*:*:*:*:*:*1.5.0 beta2Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.5.0:rc3:*:*:*:*:*:*1.5.0 rc3Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.5.0:rc4:*:*:*:*:*:*1.5.0 rc4Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.5.1:*:*:*:*:*:*:*1.5.1Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.5.1:rc1:*:*:*:*:*:*1.5.1 rc1Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.5.2:*:*:*:*:*:*:*1.5.2Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.5.3:*:*:*:*:*:*:*1.5.3Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.6.0:*:*:*:*:*:*:*1.6.0Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.6.0:beta1:*:*:*:*:*:*1.6.0 beta1Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.6.0:beta2:*:*:*:*:*:*1.6.0 beta2Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.6.0:rc1:*:*:*:*:*:*1.6.0 rc1Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.6.0:rc2:*:*:*:*:*:*1.6.0 rc2Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.6.0:rc3:*:*:*:*:*:*1.6.0 rc3Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:1.7.0:beta1:*:*:*:*:*:*1.7.0 beta1Vulnerablegeoserver
cpe:2.3:a:geoserver:geoserver:3.0:beta3:*:*:*:*:*:*3.0 beta3Vulnerablegeoserver
  • cpe:2.3:a:geoserver:geoserver:1.4.0:m1:*:*:*:*:*:* Versions 1.4.0 m1 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.5.0:beta2:*:*:*:*:*:* Versions 1.5.0 beta2 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.5.0:rc3:*:*:*:*:*:* Versions 1.5.0 rc3 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.5.0:rc4:*:*:*:*:*:* Versions 1.5.0 rc4 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.5.1:rc1:*:*:*:*:*:* Versions 1.5.1 rc1 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.6.0:beta1:*:*:*:*:*:* Versions 1.6.0 beta1 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.6.0:beta2:*:*:*:*:*:* Versions 1.6.0 beta2 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.6.0:rc1:*:*:*:*:*:* Versions 1.6.0 rc1 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.6.0:rc2:*:*:*:*:*:* Versions 1.6.0 rc2 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.6.0:rc3:*:*:*:*:*:* Versions 1.6.0 rc3 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:1.7.0:beta1:*:*:*:*:*:* Versions 1.7.0 beta1 Vulnerable ·geoserver
  • cpe:2.3:a:geoserver:geoserver:3.0:beta3:*:*:*:*:*:* Versions 3.0 beta3 Vulnerable ·geoserver

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-7227

References

Other 2

  • TI-2024-24187 Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36149 GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17518 GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code… CVSS 3.1CRITICAL 9.8
  • TI-2023-28098 GeoServer arbitrary file upload vulnerability in REST Coverage Store API CVSS 3.1HIGH 7.2
  • TI-2024-15662 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form CVSS 3.1MEDIUM 4.8
  • TI-2023-28099 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API CVSS 3.1MEDIUM 4.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences