Lucene search

GitHub_MCVELIST:CVE-2024-23818

HistoryMar 20, 2024 - 5:57 p.m.

CVE-2024-23818 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format

2024-03-2017:57:38

CWE-79

GitHub_M

www.cve.org

geoserver

xss

vulnerability

wms

openlayers

java

2.23.3

2.24.1

catalog

payload

security

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

15.5%

JSON

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user’s browser when viewed in the WMS GetMap OpenLayers Output Format. Access to the WMS OpenLayers Format is available to all users by default although data and service security may limit users’ ability to trigger the XSS. Versions 2.23.3 and 2.24.1 contain a patch for this issue.

CNA Affected

[
  {
    "vendor": "geoserver",
    "product": "geoserver",
    "versions": [
      {
        "version": "< 2.23.3",
        "status": "affected"
      },
      {
        "version": "= 2.24.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2

github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6f

github.com/geoserver/geoserver/pull/7174

github.com/geoserver/geoserver/security/advisories/GHSA-fcpm-hchj-mh72

osgeo-org.atlassian.net/browse/GEOS-11153