CVE-2024-23640

Summary

CVE-2024-23640 is a stored cross-site scripting (XSS) vulnerability affecting GeoServer, an open-source Java software for managing and sharing geospatial data. This issue, present in versions prior to 2.23.3 and 2.24.0, allows authenticated administrators with workspace-level privileges to upload JavaScript payloads into style/legend resources or specially crafted datastore files. When viewed in the Style Publisher, these payloads will execute in another user's browser. Access to the Style Publisher is available to all users, though data security may limit potential attack vectors. Versions 2.23.3 and 2.24.0 include a fix for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.