CVE-2024-35230
published 2024-12-16CVE-2024-35230: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.70%
48.4th percentile
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about page includes version and revision information about the software in use (including library and components used). This information is sensitive from a security point of view because it allows software used by the server to be easily identified. This issue has been patched in version 2.26.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| geoserver | geoserver | — | — |
| osgeo | geoserver | >= 2.0.0 < 2.25.1 | 2.25.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Welcome and About GeoServer pages communicate version and revision information
osv·2024-12-16
CVE-2024-35230 [MEDIUM] Welcome and About GeoServer pages communicate version and revision information
Welcome and About GeoServer pages communicate version and revision information
### Impact
The welcome and about page includes version and revision information about the software in use (including library and components used).
This information is sensitive from a security point of view because it allows software used by the server to be easily identified.
### Proof of Concept
1. Welcome page footer:
2. About page *build information*.
### Patches
No patch presently available.
### Workarounds
No workaround available, although the ADMIN_CONSOLE can be disabled completely.
### References
* [About GeoServer](https://docs.geoserver.org/latest/en/user/webadmin/about.html)
GHSA
Welcome and About GeoServer pages communicate version and revision information
ghsa·2024-12-16
CVE-2024-35230 [MEDIUM] CWE-200 Welcome and About GeoServer pages communicate version and revision information
Welcome and About GeoServer pages communicate version and revision information
### Impact
The welcome and about page includes version and revision information about the software in use (including library and components used).
This information is sensitive from a security point of view because it allows software used by the server to be easily identified.
### Proof of Concept
1. Welcome page footer:
2. About page *build information*.
### Patches
No patch presently available.
### Workarounds
No workaround available, although the ADMIN_CONSOLE can be disabled completely.
### References
* [About GeoServer](https://docs.geoserver.org/latest/en/user/webadmin/about.html)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8https://github.com/geoserver/geoserver/commit/8cd1590a604a10875de67b04995f1952f631f920https://github.com/geoserver/geoserver/security/advisories/GHSA-6pfc-w86r-54q6https://github.com/geoserver/geoserver/security/advisories/GHSA-6pfc-w86r-54q6
2024-12-16
Published