Lucene search

GitHub_MVULNRICHMENT:CVE-2024-23819

HistoryMar 20, 2024 - 6:00 p.m.

CVE-2024-23819 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page

2024-03-2018:00:46

CWE-79

GitHub_M

github.com

geoserver

cross-site scripting

xss

mapml

html page

vulnerability

java

security issue

patch

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

5.1

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user’s browser when viewed in the MapML HTML Page. The MapML extension must be installed and access to the MapML HTML Page is available to all users although data security may limit users’ ability to trigger the XSS. Versions 2.23.4 and 2.24.1 contain a patch for this issue.

CNA Affected

[
  {
    "vendor": "geoserver",
    "product": "geoserver",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.23.4"
      },
      {
        "status": "affected",
        "version": "= 2.24.0"
      }
    ]
  }
]

References

github.com/geoserver/geoserver/commit/6f04adbdc6c289f5cb815b1462a6bd790e3fb6ef

github.com/geoserver/geoserver/commit/df65ff05250cbb498c78af906d66e0c084ace8a1

github.com/geoserver/geoserver/pull/7175

github.com/geoserver/geoserver/security/advisories/GHSA-7x76-57fr-m5r5

osgeo-org.atlassian.net/browse/GEOS-11154