Log in Start free

Vulnerability · Published Jun 10, 2025 · Assigned by GitHub_M

CVE-2024-38524GWC Home Page communicate version and revision information

Medium 5.3

In plain English

A medium-severity information exposure in geoserver from geoserver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations. This vulnerability is fixed in 2.26.2 and 2.25.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.geoserver.web:gs-web-app2.26.2GHSA-jm79-7xhw-6f6f
Mavenorg.geoserver.web:gs-web-app2.25.6GHSA-jm79-7xhw-6f6f
Mavenorg.geoserver:gs-gwc2.26.2GHSA-jm79-7xhw-6f6f
Mavenorg.geoserver:gs-gwc2.25.6GHSA-jm79-7xhw-6f6f

Affected products (as reported)

VendorProductVersions
geoserver geoserver >= 2.26.0, < 2.26.2< 2.25.6

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References