{"id":"CVE-2024-23819","summary":"GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page","details":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the MapML HTML Page. The MapML extension must be installed and access to the MapML HTML Page is available to all users although data security may limit users' ability to trigger the XSS. Versions 2.23.4 and 2.24.1 contain a patch for this issue.","aliases":["GHSA-7x76-57fr-m5r5"],"modified":"2026-08-12T12:59:50.654730Z","published":"2024-03-20T18:00:46.048Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23819.json"},"references":[{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOS-11154"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23819.json"},{"type":"ADVISORY","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-7x76-57fr-m5r5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23819"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/6f04adbdc6c289f5cb815b1462a6bd790e3fb6ef"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/df65ff05250cbb498c78af906d66e0c084ace8a1"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/pull/7175"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/geoserver/geoserver","events":[{"introduced":"0"},{"fixed":"31f4807730bc3c65ebd6cf2cbda994e178cd3e86"},{"introduced":"a6665cb505d45b639e62ff178b507914d089a28b"},{"fixed":"6f04adbdc6c289f5cb815b1462a6bd790e3fb6ef"},{"fixed":"df65ff05250cbb498c78af906d66e0c084ace8a1"}],"database_specific":{"cpe":["cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*","cpe:2.3:a:geoserver:geoserver:2.24.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"2.23.4"},{"introduced":"2.24.0-NA"},{"last_affected":"2.24.0-NA"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["2.24.0-NA","= 2.24.0","2.21-M0","2.11-beta"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/df65ff05250cbb498c78af906d66e0c084ace8a1","target":{"file":"src/extension/mapml/src/main/java/org/geoserver/mapml/MapMLController.java","function":"Html"},"deprecated":false,"digest":{"function_hash":"239680004279125162851931711572080742131","length":3777},"id":"CVE-2024-23819-4a8a1259"},{"source":"https://github.com/geoserver/geoserver/commit/df65ff05250cbb498c78af906d66e0c084ace8a1","target":{"file":"src/extension/mapml/src/main/java/org/geoserver/mapml/MapMLController.java"},"deprecated":false,"digest":{"line_hashes":["65077943500788815397264523213804244676","218604989177063196176043364561250972233","146590680116546800993618648263277227550","123715224335185056784904651546892365426","186185190422556489988393485004673206871","283763982223064379983318795302235056034","178245634390026907093385612144396736708","219600184048974634611793322713385977935","134417855305653130415318914527344571869","50746832850229364887597583974676925481","271886748005309143987815747979496659463","129199300497202181269202053219863680832","7333166887280497327199556357809729958","148411633797465219350235258889859467273","300585378552581359563288533472626991497","57141928664799315693871461367450528423","38467330505945939184088880981392368809","261289796439750320334430936808098243179","142688571752303247072083142039695678116","86458305267955801731200172932651151729","171925648297419537779397650147707706789","112218752145751437354101751503957456522","90064130081335305534846657363823846628","145263942830732521388711565445083955154","302110011637524245045355569756376234474"],"threshold":0.9},"id":"CVE-2024-23819-53af45d9","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/6f04adbdc6c289f5cb815b1462a6bd790e3fb6ef","target":{"file":"src/extension/mapml/src/main/java/org/geoserver/mapml/MapMLController.java","function":"Html"},"deprecated":false,"digest":{"function_hash":"239680004279125162851931711572080742131","length":3777},"id":"CVE-2024-23819-621d46f2","signature_type":"Function"},{"digest":{"line_hashes":["4433584476051629983312554954222778168","337322681642976655406424142986340444660","125353184608319289991298161174815138718","222209710117566810348643750145785052403","318807950298328194102144584562818676885","268291692218397166850296576979021993711"],"threshold":0.9},"id":"CVE-2024-23819-c201adf4","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/6f04adbdc6c289f5cb815b1462a6bd790e3fb6ef","target":{"file":"src/extension/mapml/src/test/java/org/geoserver/mapml/MapMLControllerTest.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["65077943500788815397264523213804244676","218604989177063196176043364561250972233","146590680116546800993618648263277227550","123715224335185056784904651546892365426","186185190422556489988393485004673206871","283763982223064379983318795302235056034","178245634390026907093385612144396736708","219600184048974634611793322713385977935","134417855305653130415318914527344571869","50746832850229364887597583974676925481","271886748005309143987815747979496659463","129199300497202181269202053219863680832","7333166887280497327199556357809729958","148411633797465219350235258889859467273","300585378552581359563288533472626991497","57141928664799315693871461367450528423","38467330505945939184088880981392368809","261289796439750320334430936808098243179","142688571752303247072083142039695678116","86458305267955801731200172932651151729","171925648297419537779397650147707706789","112218752145751437354101751503957456522","90064130081335305534846657363823846628","145263942830732521388711565445083955154","302110011637524245045355569756376234474"]},"id":"CVE-2024-23819-cb81259d","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/6f04adbdc6c289f5cb815b1462a6bd790e3fb6ef","target":{"file":"src/extension/mapml/src/main/java/org/geoserver/mapml/MapMLController.java"}},{"deprecated":false,"digest":{"line_hashes":["4433584476051629983312554954222778168","337322681642976655406424142986340444660","125353184608319289991298161174815138718","222209710117566810348643750145785052403","318807950298328194102144584562818676885","49968843778871709673695640287210291466"],"threshold":0.9},"id":"CVE-2024-23819-d852dde3","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/df65ff05250cbb498c78af906d66e0c084ace8a1","target":{"file":"src/extension/mapml/src/test/java/org/geoserver/mapml/MapMLControllerTest.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23819.json","vanir_signatures_modified":"2026-08-12T12:59:50Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}]}