Secuno
ENNL
Book demo

CVE-2022-24816

OSGeo GeoServer JAI-EXT Code Injection

10.0 CRITICALActively exploited (CISA KEV)EPSS 99.9%
  1. Published13 Apr 2022
  2. Added to CISA KEV26 Jun 2024
  3. Remediation due17 Jul 2024
Actively exploited (CISA KEV)

OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.

Added to KEV: 26 Jun 2024Federal remediation due: 17 Jul 2024

Description

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Geosolutionsgroup Jai-ext< 1.1.22

Remediation

Fixed in
Geosolutionsgroup Jai-ext≥ 1.1.22

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1104458.8
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.…
CVE-2026-1104448.8
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.…
CVE-2026-920979.1
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary…
CVE-2026-10662410.0
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection')…
CVE-2026-1066219.1
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection')…
CVE-2026-1059039.9
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection')…

Frequently asked

Is CVE-2022-24816 being actively exploited?

Yes. CVE-2022-24816 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 26 Jun 2024.

How severe is CVE-2022-24816?

CVE-2022-24816 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 99.9% probability of exploitation.

Which products are affected by CVE-2022-24816?

Affected products include Geosolutionsgroup Jai-ext.

How do I fix CVE-2022-24816?

Upgrade affected software to a fixed version, for example Geosolutionsgroup Jai-ext 1.1.22 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-24816 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.