github.com
https://github.com/geoserver/geoserver CVE-2024-23640
MEDIUM
GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher
Record summary
CVE-2024-23640 has a selected CVSS score of 4.8 (medium).
Description
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.0 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources or in a specially crafted datastore file that will execute in the context of another user's browser when viewed in the Style Publisher. Access to the Style Publisher is available to all users although data security may limit users' ability to trigger the XSS. Versions 2.23.3 and 2.24.0 contain a fix for this issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 21, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
geoserverBrowse geoserver / geoserver | CVE List | < 2.23.3 | affected |
org.geoserver:gs-mainBrowse Maven / org.geoserver:gs-main | GitHub Advisory | Before 2.23.3 · Fixed in 2.23.3 | affected |
org.geoserver:gs-owsBrowse Maven / org.geoserver:gs-ows | GitHub Advisory | Before 2.23.3 · Fixed in 2.23.3 | affected |
References
7github.com
https://github.com/geoserver/geoserver/pull/7162 github.com
https://github.com/geoserver/geoserver/pull/7181 github.comConfirmation
https://github.com/geoserver/geoserver/security/advisories/GHSA-9rfr-pf2x-g4xf nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-23640 osgeo-org.atlassian.net
https://osgeo-org.atlassian.net/browse/GEOS-11149 osgeo-org.atlassian.net
https://osgeo-org.atlassian.net/browse/GEOS-11155