CVE-2022-24816

    Dashboard / Vulnerabilities / CVE-2022-24816

    CVE-2022-24816

    Published: 13 Apr 2022Last Modified: 12 Aug 2026

    Summary: Improper Control of Generation of Code in jai-ext

    Details: JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

    References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24816, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24816.json, https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx, https://nvd.nist.gov/vuln/detail/CVE-2022-24816, https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -3c6e347549dd32ac9a74b2d952d758191c6e094a

    Affected versions

    1.1.12
    1.1.21
    1.1.20
    1.1.19
    1.1.18
    1.1.7
    1.1.17
    1.1.16
    1.1.15
    1.1.14
    1.1.13
    1.1.11
    1.1.10
    1.1.9
    1.1.8
    1.1.6
    1.1.5
    1.1.4
    1.1.3
    1.1.2
    1.1.1
    1.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24816 | CVE-DB