Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.geoserver:gs-ows

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.8MavenPublished

    GeoServer's Style Publisher vulnerable to Stored Cross-Site Scripting (XSS)

    CVE-2024-23640 · GHSA-9rfr-pf2x-g4xf

    Affected
    • Maven org.geoserver:gs-ows < 2.23.3
    Fixed in
    2.23.3· Vendor fix available
    Issue
    A stored cross-site scripting (XSS) vulnerability exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources or in a specially crafted datastore file that will execute in the context of another user's browser when viewed in the Style Publisher. Access to the Style Publisher is available to all users although data security may limit users' ability to trigger the XSS. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: 1 .Perform any action within the application that the user can perform. 2. View any information that the user is able to view. 3.…

    Recommended action: Upgrade to 2.23.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →