{"id":"CVE-2024-35230","summary":"Welcome and About GeoServer pages communicate version and revision information","details":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about page includes version and revision information about the software in use (including library and components used). This information is sensitive from a security point of view because it allows software used by the server to be easily identified. This issue has been patched in version 2.26.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","aliases":["GHSA-6pfc-w86r-54q6"],"modified":"2026-08-12T15:16:00.426381Z","published":"2024-12-16T22:18:19.896Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35230.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35230.json"},{"type":"ADVISORY","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-6pfc-w86r-54q6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35230"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/8cd1590a604a10875de67b04995f1952f631f920"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/geoserver/geoserver","events":[{"introduced":"0"},{"fixed":"6193b5a1961a97261e07b2a501c483ba780bffae"},{"fixed":"74fdab745a5deff20ac99abca24d8695fe1a52f8"},{"fixed":"8cd1590a604a10875de67b04995f1952f631f920"}],"database_specific":{"cpe":"cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.25.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["2.21-M0","2.11-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35230.json","vanir_signatures_modified":"2026-08-12T15:16:00Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["264390384530364550376415558076538418888","66729064145699946270303527886669224462","316688617561204369679287933272458214543","223475902306217737104071908742842315985","159765343543516311903924483963028673775","163180396617571576621860191369180988959","220001906517579869089548380699027415861","177083188573367353303282244393056783537","274806334839459561306994181186088457058","160581397492471579403230022677133246967"],"threshold":0.9},"id":"CVE-2024-35230-539105e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/8cd1590a604a10875de67b04995f1952f631f920","target":{"file":"src/web/core/src/main/java/org/geoserver/web/AboutGeoServerPage.java"}},{"signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8","target":{"file":"src/web/core/src/main/java/org/geoserver/web/GeoServerBasePage.java","function":"commonBaseInit"},"deprecated":false,"digest":{"function_hash":"245456823569532183383645347260761842954","length":6237},"id":"CVE-2024-35230-55c2abd5","signature_type":"Function"},{"digest":{"line_hashes":["60847058889652797075954759931947206858","84127179937111801138315932976355439059","16920446801891026294238379234721040863","194542924889099744506088167455477306510","115024473106098135064762065195539982390","22138926825205300270555625814431385949","93658810186598002532106046423261084896","38292223904079029804271984708945396837","84005340830133593640544219567356971992","184071169051698821367569521993179555910","241892037811870067254430323351462510293"],"threshold":0.9},"id":"CVE-2024-35230-566548e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8","target":{"file":"src/web/core/src/test/java/org/geoserver/web/GeoServerHomePageTest.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["340118808320698307878614231469581158061","124089764824999923152934335691122253","48886016685142325003055164022199684918","316618477686401994484663317971028491805","65351695180026130336241994652874130304","199996094062521830704208220357282705082"],"threshold":0.9},"id":"CVE-2024-35230-75ee90d4","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/8cd1590a604a10875de67b04995f1952f631f920","target":{"file":"src/web/core/src/test/java/org/geoserver/web/GeoServerAboutPageTest.java"}},{"digest":{"line_hashes":["82381061740869158764798493510285114385","263203556606201036119699334831856786422","78043400410493152828614681101709145729","148853049548390640772200906876894905488"],"threshold":0.9},"id":"CVE-2024-35230-8c3000d7","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8","target":{"file":"src/web/core/src/main/java/org/geoserver/web/GeoServerBasePage.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"288985822217572198861655750705218978232","length":358},"id":"CVE-2024-35230-a3d09180","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8","target":{"file":"src/web/core/src/main/java/org/geoserver/web/GeoServerHomePage.java","function":"footerMessage"}},{"target":{"file":"src/web/core/src/main/java/org/geoserver/web/AboutGeoServerPage.java","function":"AboutGeoServerPage"},"deprecated":false,"digest":{"function_hash":"196698984161667706834083241694212143890","length":321},"id":"CVE-2024-35230-bfe74264","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/8cd1590a604a10875de67b04995f1952f631f920"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8","target":{"file":"src/web/core/src/main/java/org/geoserver/web/GeoServerHomePage.java"},"deprecated":false,"digest":{"line_hashes":["95551633061029672999079761429423607737","312515336884396830077256815724238704336","145047162068370158573824494467340448424"],"threshold":0.9},"id":"CVE-2024-35230-d7be4a55"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}