{"id":"CVE-2023-51445","summary":"GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API","details":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.0 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources that will execute in the context of another administrator's browser when viewed in the REST Resources API.  Access to the REST Resources API is limited to full administrators by default and granting non-administrators access to this endpoint should be carefully considered as it may allow access to files containing sensitive information. Versions 2.23.3 and 2.24.0 contain a patch for this issue.","aliases":["GHSA-fh7p-5f6g-vj2w"],"modified":"2026-08-12T14:51:48.962053Z","published":"2024-03-20T15:14:49.682Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51445.json"},"references":[{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOS-11148"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51445.json"},{"type":"ADVISORY","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-fh7p-5f6g-vj2w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51445"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/pull/7161"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/geoserver/geoserver","events":[{"introduced":"0"},{"fixed":"2cd5fe9a706b8160a9a5c5fa736c6c0fffb85b7d"},{"fixed":"7db985738ff2422019ccac974cf547bae5770cad"}],"database_specific":{"cpe":"cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.23.3"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["2.21-M0","2.11-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-51445.json","vanir_signatures_modified":"2026-08-12T14:51:48Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/resources/ResourceControllerTest.java","function":"testDirectoryJSONMultipleChildren"},"deprecated":false,"digest":{"function_hash":"203542442635088915613907805406506273402","length":1912},"id":"CVE-2023-51445-27071878","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/resources/ResourceController.java"},"deprecated":false,"digest":{"line_hashes":["220777119728382738694577284474081415675","264818031055190092119662160283618959075","157701016492843938147823584022172416198","159840141547146484710915406506114528119","245666168963811168614857748923986567643","70016150659068870420883169909992472518","252202605874658133820462888713689751339","157953807796485518416860434677507764838","169623179652371894396265563748968921625","258945082223737617553222809506264798113","252919236669829884779379680057307499510","222455918516717733216773840586680244628","151276573157826600353516898976325507838","319767822772467224352120085447028313426","120362866125278118204715247556299633408","65510677736647318277304069357276155191","213608421971712072158867295755283791283","218728858011325633425572612674612774110","139559694084762181057908520071903386178","24565751687545746214780253797478616707","339340252176632303487475592977528588681","325078072818920280203367693348001295290","202166629397616453273440503862526971522","286959121754172615278600431289815337364","216050822918518849892590517491459125198","264781130406762075079544672957359413711","184114215516760973528597099905656609186","277311470617083088835474231151673107056","160790612124571951637191921691450408913","227711090154569967368809402416134512505","93513678995294813422878436593292621533","299873744857630198062612810076494844571","171468663233972664477494778650877334576","30584587213142902972153208626010345669","146231066077977760765726816980148636942","55026420812159934878827087065999403875","120579921280691771708397491220531568867","240458816696623824603363489237461073422","26465528281138146060263031816472738446","115645637293658955791388399924384006917","296393462772036109365415582764668693059","155518448517034746495458730608630895860","179861855919833598168621507539194359460","92605253192100938440501218265378754532","195135684598700202099638843247158927967","309785182436396836068732266930531017206","93344929099266208817864379211284479144","30703146417676686070564091297021310648","37009711986985648491628511445271122615","7081324481376662048874381976906151309","109244447952681830389228528956447119679","134314906077627961710820279350289134835"],"threshold":0.9},"id":"CVE-2023-51445-2dabc673","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"286639394461913598812744783474399887480","length":534},"id":"CVE-2023-51445-6a817909","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/resources/ResourceControllerTest.java","function":"testResourceHeaders"}},{"signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad","target":{"function":"testResourceHead","file":"src/restconfig/src/test/java/org/geoserver/rest/resources/ResourceControllerTest.java"},"deprecated":false,"digest":{"function_hash":"286639394461913598812744783474399887480","length":534},"id":"CVE-2023-51445-72069e55","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/resources/ResourceControllerTest.java"},"deprecated":false,"digest":{"line_hashes":["4934651305252479908147852187972080321","182061914090674391578736660279146479764","296665671504894540953482449106157888731","97432575656536430349624724108219663702","317900468743188704292559299516727708964","185578992494396439296849585448026221339","105772416616957092130207546535816676545","21929449441708205136938002259195681551","3240572821246076151467218974406931489","332659927397533026527063545056872258946","311020387447575713873770806337152671316","183456785398274314602156036197159955867","223534101560623665490700388543566338236","234556889283432947501436254665439042463","254413720665898702394936532755282419136","39885556568263631674294642176268501453","270147106778390960143026188007287197753","38495363084348915903432943628337359189","248359693846736024312808758665185899698","318574686136290845442226412448118162710","233276963716318275396060706437374945989","223534101560623665490700388543566338236","234556889283432947501436254665439042463","254413720665898702394936532755282419136","221832693040869882261481880957183228997","38669282636321733987319700599669144607","109300439870329153254840281171213251940","259859929372981905004231494382629141103","150919739844916931934738889757347517680","279115147121942254177078056426723652421","300577680569713813722228363104690981743","115061640986500931974926233181679978398","217911501250392880470461726184578239476","305244174976598342879630622616200557864","242389700930321054684043842615606119686","229679572288274887081972407358018270833","189741773278388742604010606247795822335","210586151153197662039681079762959502341","114953813047929875314113707582535820205","62862743957146379445330691943008290325","237328627771988997771234767916329485054","289899261725860260146936537554063679446"],"threshold":0.9},"id":"CVE-2023-51445-7335ea23"},{"signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/resources/ResourceController.java","function":"getMediaType"},"deprecated":false,"digest":{"function_hash":"258263365745263256727818913453735679884","length":598},"id":"CVE-2023-51445-75a9dd15","signature_type":"Function"},{"digest":{"function_hash":"273726659065816818282861650260544513324","length":406},"id":"CVE-2023-51445-a5f18936","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/resources/ResourceControllerTest.java","function":"testDirectoryMimeTypes"},"deprecated":false},{"source":"https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/resources/ResourceController.java","function":"resourceGet"},"deprecated":false,"digest":{"function_hash":"31411641411437341532414743041891982930","length":1537},"id":"CVE-2023-51445-fd6ca77c","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}]}