CVE-2024-23640

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.0 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources or in a specially crafted datastore file that will execute in the context of another user's browser when viewed in the Style Publisher. Access to the Style Publisher is available to all users although data security may limit users' ability to trigger the XSS. Versions 2.23.3 and 2.24.0 contain a fix for this issue.

• CWE-79
• CWE-79

• https://github.com/geoserver/geoserver/pull/7162Issue Tracking
• https://github.com/geoserver/geoserver/pull/7181Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-9rfr-pf2x-g4xfVendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11149Issue Tracking
• https://osgeo-org.atlassian.net/browse/GEOS-11155Issue Tracking
• https://github.com/geoserver/geoserver/pull/7162Issue Tracking
• https://github.com/geoserver/geoserver/pull/7181Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-9rfr-pf2x-g4xfVendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11149Issue Tracking
• https://osgeo-org.atlassian.net/browse/GEOS-11155Issue Tracking

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23635AntiSamy is a library for performing fast, configurable clea…6.1
• CVE-2024-23636SOFARPC is a Java RPC framework. SOFARPC defaults to using t…9.8
• CVE-2024-23637OctoPrint is a web interface for 3D printer.s OctoPrint vers…4.9
• CVE-2024-23638Squid is a caching proxy for the Web. Due to an expired poin…6.5
• CVE-2024-23639Micronaut Framework is a modern, JVM-based, full stack Java …7.8
• CVE-2024-2364A vulnerability classified as problematic has been found in …4.6
• CVE-2024-23641SvelteKit is a web development kit. In SvelteKit 2, sending …7.5
• CVE-2024-23642GeoServer is an open source software server written in Java …4.8
• CVE-2024-23643GeoServer is an open source software server written in Java …4.8
• CVE-2024-23644Trillium is a composable toolkit for building internet appli…8.1
• CVE-2024-23645GLPI is a Free Asset and IT Management Software package. A m…6.1
• CVE-2024-23646Pimcore's Admin Classic Bundle provides a backend user inter…8.8