Information disclosure in Geoserver
CVE-2024-35230
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about page includes version and revision information about the software in use (including…
Vulnerability class: Information Disclosure
EPSS: 0.002 (46.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Geoserver — versions >= 2.0.0, < 2.26.0
Weakness classification (CWE)
References
- https://github.com/geoserver/geoserver/security/advisories/GHSA-6pfc-w86r-54q6 (x_refsource_CONFIRM)
- https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8 (x_refsource_MISC)
- https://github.com/geoserver/geoserver/commit/8cd1590a604a10875de67b04995f1952f631f920 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-35230?
- CVE-2024-35230 is a medium-severity vulnerability in Geoserver, classified under Information Disclosure. CVSS score: 5.3/10. Published 2024-12-16.
- How severe is CVE-2024-35230?
- Medium severity. CVSS v3 base score is 5.3 out of 10.