CVE-2024-23819

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the MapML HTML Page. The MapML extension must be installed and access to the MapML HTML Page is available to all users although data security may limit users' ability to trigger the XSS. Versions 2.23.4 and 2.24.1 contain a patch for this issue.

• CWE-79
• CWE-79

• https://github.com/geoserver/geoserver/commit/6f04adbdc6c289f5cb815b1462a6bd790e3fb6efPatch
• https://github.com/geoserver/geoserver/commit/df65ff05250cbb498c78af906d66e0c084ace8a1Patch
• https://github.com/geoserver/geoserver/pull/7175Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-7x76-57fr-m5r5Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11154Issue Tracking
• https://github.com/geoserver/geoserver/commit/6f04adbdc6c289f5cb815b1462a6bd790e3fb6efPatch
• https://github.com/geoserver/geoserver/commit/df65ff05250cbb498c78af906d66e0c084ace8a1Patch
• https://github.com/geoserver/geoserver/pull/7175Issue Tracking
• https://github.com/geoserver/geoserver/security/advisories/GHSA-7x76-57fr-m5r5Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11154Issue Tracking

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23813A vulnerability has been identified in Polarion ALM (All ver…9.8
• CVE-2024-23814The integrated ICMP service of the network stack of affected…6.9
• CVE-2024-23815A vulnerability has been identified in Desigo CC (All versio…8.7
• CVE-2024-23816A vulnerability has been identified in Location Intelligence…9.8
• CVE-2024-23817Dolibarr is an enterprise resource planning (ERP) and custom…6.1
• CVE-2024-23818GeoServer is an open source software server written in Java …4.8
• CVE-2024-2382The Authorize.net Payment Gateway For WooCommerce plugin for…5.3
• CVE-2024-23820OpenFGA, an authorization/permission engine, is vulnerable t…6.5
• CVE-2024-23821GeoServer is an open source software server written in Java …4.8
• CVE-2024-23822Thruk is a multibackend monitoring webinterface. Prior to 3…9.8
• CVE-2024-23823vantage6 is an open source framework built to enable, manage…6.5
• CVE-2024-23824mailcow is a dockerized email package, with multiple contain…2.7