{"id":"CVE-2024-23818","summary":"GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format","details":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap OpenLayers Output Format.  Access to the WMS OpenLayers Format is available to all users by default although data and service security may limit users' ability to trigger the XSS. Versions 2.23.3 and 2.24.1 contain a patch for this issue.","aliases":["GHSA-fcpm-hchj-mh72"],"modified":"2026-08-12T15:15:02.153885Z","published":"2024-03-20T17:57:38.893Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23818.json"},"references":[{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOS-11153"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23818.json"},{"type":"ADVISORY","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-fcpm-hchj-mh72"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23818"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6f"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/pull/7174"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/geoserver/geoserver","events":[{"introduced":"0"},{"fixed":"2cd5fe9a706b8160a9a5c5fa736c6c0fffb85b7d"},{"introduced":"a6665cb505d45b639e62ff178b507914d089a28b"},{"fixed":"4557a832eed19ec18b9753cb97e8aa85269741d2"},{"fixed":"a26c32a469ee4c599236380452ffb4260361bd6f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.23.3"},{"introduced":"2.24.0-NA"},{"last_affected":"2.24.0-NA"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*","cpe:2.3:a:geoserver:geoserver:2.24.0:-:*:*:*:*:*:*"]}}],"versions":["2.24.0-NA","= 2.24.0","2.21-M0","2.11-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23818.json","vanir_signatures_modified":"2026-08-12T15:15:02Z","vanir_signatures":[{"source":"https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6f","target":{"function":"testXssFix","file":"src/wms/src/test/java/org/geoserver/wms/map/OpenLayersMapOutputFormatTest.java"},"deprecated":false,"digest":{"function_hash":"162852862137982352561524146406188703002","length":1383},"id":"CVE-2024-23818-252b07eb","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/wms/src/test/java/org/geoserver/wms/map/OpenLayersMapOutputFormatTest.java","function":"testXssOL3"},"deprecated":false,"digest":{"function_hash":"103541133623903565671385216271101314267","length":1435},"id":"CVE-2024-23818-2cfa0b2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6f"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2","target":{"file":"src/wms/src/test/java/org/geoserver/wms/map/OpenLayersMapOutputFormatTest.java","function":"testXssFix"},"deprecated":false,"digest":{"function_hash":"162852862137982352561524146406188703002","length":1383},"id":"CVE-2024-23818-72522462"},{"deprecated":false,"digest":{"function_hash":"103541133623903565671385216271101314267","length":1435},"id":"CVE-2024-23818-860bce1a","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2","target":{"file":"src/wms/src/test/java/org/geoserver/wms/map/OpenLayersMapOutputFormatTest.java","function":"testXssOL3"}},{"signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2","target":{"file":"src/wms/src/test/java/org/geoserver/wms/map/OpenLayersMapOutputFormatTest.java"},"deprecated":false,"digest":{"line_hashes":["224264937081916243836141923898132492611","294459535711436370538729170487043712308","40235694257250725338840524448157626459","286705106247018954640487693570175228780","94378562485952067029096021219677592071","207464686002787945655241648622529118247","14783354295156376914351387270319617198","191670145529259986513945679022408454147","339257218031115495822818571895945465508","337112281106764398972222088083213514840","209677558201897700165162062696381557905","74070049806932761481346383588348488066","203868636115539953986162529489221064936","174572295610254579738678258181604228752","229723538630384662215646493735858597638","298181646088304387709029869177554211237","172519815653351051656715243472479806380","29682433511462476489266422438799977432","197207243588206481245636480066718624198","289868365059570534699332817708904681132","44265425178525496768276308264645597763","129545233307009849658929389774372115483","191670145529259986513945679022408454147","339257218031115495822818571895945465508","337112281106764398972222088083213514840","209677558201897700165162062696381557905","74070049806932761481346383588348488066","203868636115539953986162529489221064936","174572295610254579738678258181604228752","229723538630384662215646493735858597638","298181646088304387709029869177554211237","172519815653351051656715243472479806380","271059655596522285220343297645912786214"],"threshold":0.9},"id":"CVE-2024-23818-a7fd2bd0","signature_type":"Line"},{"id":"CVE-2024-23818-d6447ef6","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6f","target":{"file":"src/wms/src/test/java/org/geoserver/wms/map/OpenLayersMapOutputFormatTest.java"},"deprecated":false,"digest":{"line_hashes":["224264937081916243836141923898132492611","294459535711436370538729170487043712308","40235694257250725338840524448157626459","286705106247018954640487693570175228780","94378562485952067029096021219677592071","207464686002787945655241648622529118247","14783354295156376914351387270319617198","191670145529259986513945679022408454147","339257218031115495822818571895945465508","337112281106764398972222088083213514840","209677558201897700165162062696381557905","74070049806932761481346383588348488066","203868636115539953986162529489221064936","174572295610254579738678258181604228752","229723538630384662215646493735858597638","298181646088304387709029869177554211237","172519815653351051656715243472479806380","29682433511462476489266422438799977432","197207243588206481245636480066718624198","289868365059570534699332817708904681132","44265425178525496768276308264645597763","129545233307009849658929389774372115483","191670145529259986513945679022408454147","339257218031115495822818571895945465508","337112281106764398972222088083213514840","209677558201897700165162062696381557905","74070049806932761481346383588348488066","203868636115539953986162529489221064936","174572295610254579738678258181604228752","229723538630384662215646493735858597638","298181646088304387709029869177554211237","172519815653351051656715243472479806380","271059655596522285220343297645912786214"],"threshold":0.9}},{"digest":{"line_hashes":["241159091924052138102429844631583455424","266612685684535735447485710816566822030","2505040059849479366980853866073117986","178466140869489779666401568228565195429","75450498022407658115503417247719368170","124118249392246653729084599759132752733"],"threshold":0.9},"id":"CVE-2024-23818-d81a94d0","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6f","target":{"file":"src/wms/src/main/java/org/geoserver/wms/map/AbstractOpenLayersMapOutputFormat.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2","target":{"file":"src/wms/src/main/java/org/geoserver/wms/map/AbstractOpenLayersMapOutputFormat.java"},"deprecated":false,"digest":{"line_hashes":["241159091924052138102429844631583455424","266612685684535735447485710816566822030","2505040059849479366980853866073117986","178466140869489779666401568228565195429","75450498022407658115503417247719368170","124118249392246653729084599759132752733"],"threshold":0.9},"id":"CVE-2024-23818-e3b9cb86","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}]}