CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2024-38524
High (7.5) in osgeo geoserver. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.geoserver.web:gs-web-app 2.25.6, 2.26.2.
GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations. This vulnerability is fixed in 2.26.2 and 2.25.6.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- osgeo:geoserver
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jm79-7xhw-6f6f | Maven | org.geoserver.web:gs-web-app | >=2.26.0 <2.26.2 | 2.26.2 |
| GHSA-jm79-7xhw-6f6f | Maven | org.geoserver.web:gs-web-app | <2.25.6 | 2.25.6 |
| GHSA-jm79-7xhw-6f6f | Maven | org.geoserver:gs-gwc | >=2.26.0 <2.26.2 | 2.26.2 |
| GHSA-jm79-7xhw-6f6f | Maven | org.geoserver:gs-gwc | <2.25.6 | 2.25.6 |