Skip to content
OpenAdvisories
Medium WID-SEC-2025-1267 4 CVEs

GeoServer: Mehrere Schwachstellen

Published Jun 9, 2025 · Updated Jun 9, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GeoServer ausnutzen, um Informationen offenzulegen oder Sicherheitsvorkehrungen zu umgehen.

Product

GeoServer ist ein Open-Source-Server zum Teilen von Geodaten.

Vulnerabilities 4

  • Critical 9.3
    CVE-2024-34711

    GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

    GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP serv…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver.main:gs-main Maven
  • Medium 5.5
    CVE-2024-40625

    GeoServer Coverage REST API Allows Server Side Request Forgery

    GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals …

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-rest Maven
  • Medium 5.3
    CVE-2024-38524

    GWC Home Page communicate version and revision information

    GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-gwc Maven
  • Medium 5.3
    CVE-2025-27505 Scanner template

    GeoServer Missing Authorization on REST API Index

    GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g.,…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-rest Maven

Revision history

  1. #1

    Initiale Fassung

References