{"id":"CVE-2024-23642","summary":"GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer","details":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap SVG Output Format when the Simple SVG renderer is enabled. Access to the WMS SVG Format is available to all users by default although data and service security may limit users' ability to trigger the XSS. Versions 2.23.4 and 2.24.1 contain a fix for this issue.","aliases":["GHSA-fg9v-56hw-g525"],"modified":"2026-08-12T12:59:50.913432Z","published":"2024-03-20T17:44:49.153Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23642.json"},"references":[{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOS-11152"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23642.json"},{"type":"ADVISORY","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-fg9v-56hw-g525"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23642"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/1b1835afbb9c282d1840786259aeda81c1d22b00"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/9f40265febb5939f23e2c53930c9c35e93970afe"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/pull/7173"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/geoserver/geoserver","events":[{"introduced":"0"},{"fixed":"31f4807730bc3c65ebd6cf2cbda994e178cd3e86"},{"introduced":"a6665cb505d45b639e62ff178b507914d089a28b"},{"fixed":"1b1835afbb9c282d1840786259aeda81c1d22b00"},{"fixed":"9f40265febb5939f23e2c53930c9c35e93970afe"}],"database_specific":{"cpe":["cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*","cpe:2.3:a:geoserver:geoserver:2.24.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"2.23.4"},{"introduced":"2.24.0-NA"},{"last_affected":"2.24.0-NA"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["2.24.0-NA","= 2.24.0","2.21-M0","2.11-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23642.json","vanir_signatures_modified":"2026-08-12T12:59:50Z","vanir_signatures":[{"source":"https://github.com/geoserver/geoserver/commit/1b1835afbb9c282d1840786259aeda81c1d22b00","target":{"file":"src/wms/src/test/java/org/geoserver/wms/svg/SVGMapProducerTest.java"},"deprecated":false,"digest":{"line_hashes":["28989427306838036666191764368127087019","227724648643141773226102236038430051507","49374078520432339842615945350819074232","312145193596738765291658209534873310055","287974829557804608411702653923576052695","86024723743433060550759137463205610819","174270388590552958375469606806467355603","151811298287936776042454267666760403904","297044253869544976262980169974451249011","57506339568873175282688183782126127620","240458069525906907247455836109463206894","11243192975769394189722624888310936838","43222392422224064075568070511876883130","244980516137951404110289114143252547243","65237100167846684154264665890870545846","75221977794800845461539491819008215059","191181557685019138329322247220769870164","186629905302326466007524229723606301556","324872945066893581468670900224897447777","57736464726956273803011297621173726835","312087197892017402532362076113426565226","242073896018061563466571473305263741645","76381818027523474932407494284047958538","271912409866617433626355450648322540810","299538226228920089444118002685051211834","139350229008831252967533179899788260432","108175288018437043459706266134942896714","221524301218107512086468382193276127795","43942792188877953218955710220261050277","245244215780013976119127269246411090765","330865233686764998569996384539681553199","98719167999691207834241720714768147721","333695452903438410535771809590715399976","21048256881013121764906072042181727718","157536926380755476324150870548953430252","227167648238401456063184013930770278365","74251244801106736781632000406092437767","276676568713173283471275718792436504308","290855784256081036058534693097598927967","106057610585693839415611121158634562390","339645511192213190669466033893318325299","27324750351351737337044631728552459593","156102077516371923173599512052448611678","125648131349094943538088851143658468902","310690937683797425641530411491198058546","177335945318790797627915948420479867556","72359584191370750955420675586825704120","115969420398878746213258376493344568046","133093764149735558189057197533039437097","250484365820190219378975078179948198770","31050692853240828414742217315582496184","44866407935693191620682663619575948967","327774504217354263547778302246460499094","91649035288114447937773056292702720656","41768493606113619357537399090478841276"],"threshold":0.9},"id":"CVE-2024-23642-0b9fd131","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2024-23642-291dc56d","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/9f40265febb5939f23e2c53930c9c35e93970afe","target":{"file":"src/wms/src/test/java/org/geoserver/wms/svg/SVGMapProducerTest.java","function":"testHeterogeneousGeometry"},"deprecated":false,"digest":{"function_hash":"139779381118206583921400674215620409856","length":2440}},{"digest":{"function_hash":"173537493129501610488602694064064356589","length":1535},"id":"CVE-2024-23642-493cfd60","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/9f40265febb5939f23e2c53930c9c35e93970afe","target":{"file":"src/wms/src/main/java/org/geoserver/wms/svg/StreamingSVGMap.java","function":"writeLayers"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["28989427306838036666191764368127087019","227724648643141773226102236038430051507","49374078520432339842615945350819074232","312145193596738765291658209534873310055","287974829557804608411702653923576052695","86024723743433060550759137463205610819","174270388590552958375469606806467355603","58309900937273582417584944969048487129","337155471088423512188424251354565923719","242937374555200011251744712826732619199","240458069525906907247455836109463206894","11243192975769394189722624888310936838","43222392422224064075568070511876883130","244980516137951404110289114143252547243","65237100167846684154264665890870545846","75221977794800845461539491819008215059","191181557685019138329322247220769870164","186629905302326466007524229723606301556","324872945066893581468670900224897447777","57736464726956273803011297621173726835","312087197892017402532362076113426565226","242073896018061563466571473305263741645","76381818027523474932407494284047958538","271912409866617433626355450648322540810","299538226228920089444118002685051211834","139350229008831252967533179899788260432","108175288018437043459706266134942896714","221524301218107512086468382193276127795","43942792188877953218955710220261050277","245244215780013976119127269246411090765","330865233686764998569996384539681553199","98719167999691207834241720714768147721","333695452903438410535771809590715399976","21048256881013121764906072042181727718","157536926380755476324150870548953430252","227167648238401456063184013930770278365","74251244801106736781632000406092437767","276676568713173283471275718792436504308","290855784256081036058534693097598927967","106057610585693839415611121158634562390","339645511192213190669466033893318325299","27324750351351737337044631728552459593","156102077516371923173599512052448611678","125648131349094943538088851143658468902","310690937683797425641530411491198058546","177335945318790797627915948420479867556","72359584191370750955420675586825704120","115969420398878746213258376493344568046","133093764149735558189057197533039437097","250484365820190219378975078179948198770","31050692853240828414742217315582496184","44866407935693191620682663619575948967","327774504217354263547778302246460499094","91649035288114447937773056292702720656","41768493606113619357537399090478841276"],"threshold":0.9},"id":"CVE-2024-23642-4f71a4a7","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/9f40265febb5939f23e2c53930c9c35e93970afe","target":{"file":"src/wms/src/test/java/org/geoserver/wms/svg/SVGMapProducerTest.java"}},{"deprecated":false,"digest":{"line_hashes":["311952835181522020480119033628666314762","204789290015046742593660706591396021698","223415956890412334633852579570655992874","188186490616662212110423223841530341002","217547669369997467286528063667891493198","257928558127368284170847614206040682531","117257957723289259219608666743340016216"],"threshold":0.9},"id":"CVE-2024-23642-522b25f4","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/1b1835afbb9c282d1840786259aeda81c1d22b00","target":{"file":"src/wms/src/main/java/org/geoserver/wms/svg/StreamingSVGMap.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/9f40265febb5939f23e2c53930c9c35e93970afe","target":{"file":"src/wms/src/main/java/org/geoserver/wms/svg/StreamingSVGMap.java"},"deprecated":false,"digest":{"line_hashes":["311952835181522020480119033628666314762","204789290015046742593660706591396021698","223415956890412334633852579570655992874","188186490616662212110423223841530341002","217547669369997467286528063667891493198","257928558127368284170847614206040682531","117257957723289259219608666743340016216"],"threshold":0.9},"id":"CVE-2024-23642-5d04a1a6"},{"digest":{"function_hash":"173537493129501610488602694064064356589","length":1535},"id":"CVE-2024-23642-87be42f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/1b1835afbb9c282d1840786259aeda81c1d22b00","target":{"file":"src/wms/src/main/java/org/geoserver/wms/svg/StreamingSVGMap.java","function":"writeLayers"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"139779381118206583921400674215620409856","length":2440},"id":"CVE-2024-23642-ee1ecf9b","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/1b1835afbb9c282d1840786259aeda81c1d22b00","target":{"file":"src/wms/src/test/java/org/geoserver/wms/svg/SVGMapProducerTest.java","function":"testHeterogeneousGeometry"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}]}