CVE-2024-38524
GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations. This vulnerability is fixed in 2.26.2 and 2.25.6.
| Software | From | Fixed in |
|---|---|---|
org.geoserver.web / gs-web-app
|
2.26.0 | 2.26.2 |
|
org.geoserver.web / gs-web-app
|
- | 2.25.6 |
|
org.geoserver / gs-gwc
|
2.26.0 | 2.26.2 |
|
org.geoserver / gs-gwc
|
- | 2.25.6 |
| osgeo / geoserver | - | 2.25.6 |
| osgeo / geoserver | 2.26.0 | 2.26.2 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime