Stored Cross-Site Scripting (XSS) vulnerability in GeoServer's REST Resources API

🗓️ 20 Mar 2024 14:58:17Reported by GitHub Advisory DatabaseType

Stored XSS vulnerability in GeoServer's REST Resources API allows authenticated admin to upload malicious files, execute JavaScript in another admin's browser, and steal cookies. Non-admin access to API should be carefully granted. Attackers can fully compromise user, perform, modify, and view info.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2023-51445	19 Mar 202419:13	–	circl
CNNVD	GeoServer Cross-Site Scripting Vulnerability	20 Mar 202400:00	–	cnnvd
CVE	CVE-2023-51445	20 Mar 202415:14	–	cve
Cvelist	CVE-2023-51445 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API	20 Mar 202415:14	–	cvelist
EUVD	EUVD-2024-0920	3 Oct 202520:07	–	euvd
NVD	CVE-2023-51445	20 Mar 202416:15	–	nvd
OSV	CVE-2023-51445 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API	20 Mar 202415:14	–	osv
OSV	GHSA-FH7P-5F6G-VJ2W Stored Cross-Site Scripting (XSS) vulnerability in GeoServer's REST Resources API	20 Mar 202414:58	–	osv
Positive Technologies	PT-2024-14127 · Geoserver · Geoserver	20 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2023-51445	23 May 202502:17	–	redhatcve

Vulners

Node

org.geoserver gs-restconfigRange<2.23.3maven

Source	Link
github	www.github.com/geoserver/geoserver/security/advisories/GHSA-fh7p-5f6g-vj2w
github	www.github.com/geoserver/geoserver/pull/7161
github	www.github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad
osgeo-org	www.osgeo-org.atlassian.net/browse/GEOS-11148
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-51445
github	www.github.com/advisories/GHSA-fh7p-5f6g-vj2w

07 Sep 2024 22:02Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.14.8

EPSS0.00979

SSVC

CWE-79