CVE-2024-23642

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap SVG Output Format when the Simple SVG renderer is enabled. Access to the WMS SVG Format is available to all users by default although data and service security may limit users' ability to trigger the XSS. Versions 2.23.4 and 2.24.1 contain a fix for this issue.

• CWE-79
• CWE-79

• https://github.com/geoserver/geoserver/commit/1b1835afbb9c282d1840786259aeda81c1d22b00Patch
• https://github.com/geoserver/geoserver/commit/9f40265febb5939f23e2c53930c9c35e93970afePatch
• https://github.com/geoserver/geoserver/pull/7173Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-fg9v-56hw-g525Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11152Issue Tracking
• https://github.com/geoserver/geoserver/commit/1b1835afbb9c282d1840786259aeda81c1d22b00Patch
• https://github.com/geoserver/geoserver/commit/9f40265febb5939f23e2c53930c9c35e93970afePatch
• https://github.com/geoserver/geoserver/pull/7173Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-fg9v-56hw-g525Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11152Issue Tracking

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23637OctoPrint is a web interface for 3D printer.s OctoPrint vers…4.9
• CVE-2024-23638Squid is a caching proxy for the Web. Due to an expired poin…6.5
• CVE-2024-23639Micronaut Framework is a modern, JVM-based, full stack Java …7.8
• CVE-2024-2364A vulnerability classified as problematic has been found in …4.6
• CVE-2024-23640GeoServer is an open source software server written in Java …4.8
• CVE-2024-23641SvelteKit is a web development kit. In SvelteKit 2, sending …7.5
• CVE-2024-23643GeoServer is an open source software server written in Java …4.8
• CVE-2024-23644Trillium is a composable toolkit for building internet appli…8.1
• CVE-2024-23645GLPI is a Free Asset and IT Management Software package. A m…6.1
• CVE-2024-23646Pimcore's Admin Classic Bundle provides a backend user inter…8.8
• CVE-2024-23647Authentik is an open-source Identity Provider. There is a bu…8.8
• CVE-2024-23648Pimcore's Admin Classic Bundle provides a backend user inter…8.8