github.com
https://github.com/GeoWebCache/geowebcache/issues/1344 CVE-2024-38524
MEDIUM
GWC Home Page communicate version and revision information
Record summary
CVE-2024-38524 has a selected CVSS score of 5.3 (medium).
Description
GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations. This vulnerability is fixed in 2.26.2 and 2.25.6.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 10, 2025 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
geoserverBrowse geoserver / geoserver | CVE List | >= 2.26.0, < 2.26.2 | affected |
| < 2.25.6 | affected | ||
org.geoserver.web:gs-web-appBrowse Maven / org.geoserver.web:gs-web-app | GitHub Advisory | 2.26.0 to < 2.26.2 · Fixed in 2.26.2 | affected |
| Before 2.25.6 · Fixed in 2.25.6 | affected | ||
org.geoserver:gs-gwcBrowse Maven / org.geoserver:gs-gwc | GitHub Advisory | 2.26.0 to < 2.26.2 · Fixed in 2.26.2 | affected |
| Before 2.25.6 · Fixed in 2.25.6 | affected |
References
7github.com
https://github.com/GeoWebCache/geowebcache/pull/1345 github.com
https://github.com/geoserver/geoserver github.com
https://github.com/geoserver/geoserver/pull/8189 github.comConfirmation
https://github.com/geoserver/geoserver/security/advisories/GHSA-jm79-7xhw-6f6f nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-38524 osgeo-org.atlassian.net
https://osgeo-org.atlassian.net/browse/GEOS-11677