CVE-2024-23643

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.2 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another administrator’s browser when viewed in the GWC Seed Form. Access to the GWC Seed Form is limited to full administrators by default and granting non-administrators access to this endpoint is not recommended. Versions 2.23.2 and 2.24.1 contain a fix for this issue.

• CWE-79
• CWE-79

• https://github.com/GeoWebCache/geowebcache/commit/9d010e09c784690ada8af43f594461a2553a62f0Patch
• https://github.com/GeoWebCache/geowebcache/issues/1172Issue Tracking
• https://github.com/GeoWebCache/geowebcache/pull/1174Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-56r3-f536-5gf7Vendor Advisory
• https://github.com/GeoWebCache/geowebcache/commit/9d010e09c784690ada8af43f594461a2553a62f0Patch
• https://github.com/GeoWebCache/geowebcache/issues/1172Issue Tracking
• https://github.com/GeoWebCache/geowebcache/pull/1174Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-56r3-f536-5gf7Vendor Advisory

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23638Squid is a caching proxy for the Web. Due to an expired poin…6.5
• CVE-2024-23639Micronaut Framework is a modern, JVM-based, full stack Java …7.8
• CVE-2024-2364A vulnerability classified as problematic has been found in …4.6
• CVE-2024-23640GeoServer is an open source software server written in Java …4.8
• CVE-2024-23641SvelteKit is a web development kit. In SvelteKit 2, sending …7.5
• CVE-2024-23642GeoServer is an open source software server written in Java …4.8
• CVE-2024-23644Trillium is a composable toolkit for building internet appli…8.1
• CVE-2024-23645GLPI is a Free Asset and IT Management Software package. A m…6.1
• CVE-2024-23646Pimcore's Admin Classic Bundle provides a backend user inter…8.8
• CVE-2024-23647Authentik is an open-source Identity Provider. There is a bu…8.8
• CVE-2024-23648Pimcore's Admin Classic Bundle provides a backend user inter…8.8
• CVE-2024-23649Lemmy is a link aggregator and forum for the fediverse. Star…6.5