GitHub Advisoryadvisory · Maven

GHSA-6pfc-w86r-54q6 Welcome and About GeoServer pages communicate version and revision information

MEDIUM Published 2024-12-16 Modified 2024-12-17 Official page ↗
Aliases
CVE-2024-35230
Ecosystem
Maven
Packages
org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-12-16

Affected packages

• Maven org.geoserver.web:gs-web-app: >= 2.0.0, < 2.25.1 → fixed in 2.25.1 • Maven org.geoserver.web:gs-web-core: >= 2.0.0, < 2.25.1 → fixed in 2.25.1

Description

Impact The welcome and about page includes version and revision information about the software in use (including library and components used). This information is sensitive from a security point of view because it allows software used by the server to be easily identified. Proof of Concept 1. Welcome page footer: 2. About page *build information*. Patches No patch presently available. Workarounds No workaround available, although the ADMIN_CONSOLE can be disabled completely. References • About GeoServer

Related

Alias · CVE (1)

  • CVE-2024-35230 GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References