CVE-2024-23818

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap OpenLayers Output Format. Access to the WMS OpenLayers Format is available to all users by default although data and service security may limit users' ability to trigger the XSS. Versions 2.23.3 and 2.24.1 contain a patch for this issue.

• CWE-79
• CWE-79

• https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2Patch
• https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6fPatch
• https://github.com/geoserver/geoserver/pull/7174Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-fcpm-hchj-mh72Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11153Issue Tracking
• https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2Patch
• https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6fPatch
• https://github.com/geoserver/geoserver/pull/7174Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-fcpm-hchj-mh72Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11153Issue Tracking

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23812A vulnerability has been identified in SINEC NMS (All versio…8.8
• CVE-2024-23813A vulnerability has been identified in Polarion ALM (All ver…9.8
• CVE-2024-23814The integrated ICMP service of the network stack of affected…6.9
• CVE-2024-23815A vulnerability has been identified in Desigo CC (All versio…8.7
• CVE-2024-23816A vulnerability has been identified in Location Intelligence…9.8
• CVE-2024-23817Dolibarr is an enterprise resource planning (ERP) and custom…6.1
• CVE-2024-23819GeoServer is an open source software server written in Java …4.8
• CVE-2024-2382The Authorize.net Payment Gateway For WooCommerce plugin for…5.3
• CVE-2024-23820OpenFGA, an authorization/permission engine, is vulnerable t…6.5
• CVE-2024-23821GeoServer is an open source software server written in Java …4.8
• CVE-2024-23822Thruk is a multibackend monitoring webinterface. Prior to 3…9.8
• CVE-2024-23823vantage6 is an open source framework built to enable, manage…6.5