CVE-2024-23640

MEDIUM EPSS 34.2%

Published Mar 20, 20242y ago · Modified Jun 17, 20262w ago

4.8 CVSS 3.1

Medium

Published Mar 20, 2024 2y ago

Last Modified Jun 17, 2026 2w ago

Description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.0 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources or in a specially crafted datastore file that will execute in the context of another user's browser when viewed in the Style Publisher. Access to the Style Publisher is available to all users although data security may limit users' ability to trigger the XSS. Versions 2.23.3 and 2.24.0 contain a fix for this issue.

CVSS Details

Base Score

4.8

Exploitability

1.7

Impact

2.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction Required

Scope Changed

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

34.2% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
geoserver	geoserver	*	<2.23.3

References 5

github.com https://github.com/geoserver/geoserver/pull/7162

Issue Tracking
github.com https://github.com/geoserver/geoserver/pull/7181

Issue Tracking
github.com https://github.com/geoserver/geoserver/security/advisories/GHSA-9rfr-pf2x-g4xf

Vendor Advisory
osgeo-org.atlassian.net https://osgeo-org.atlassian.net/browse/GEOS-11149

Issue Tracking
osgeo-org.atlassian.net https://osgeo-org.atlassian.net/browse/GEOS-11155

Issue Tracking

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.