Skip to content
OpenAdvisories

Package · Maven

org.geoserver:gs-main

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 7.2
    CVE-2024-45747

    GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

    ### Summary A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server…

    org.geoserver.web:gs-web-app org.geoserver:gs-wms org.geoserver:gs-main Maven
  • Medium 6.5
    CVE-2025-58175

    GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

    GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). …

    geoserver org.geoserver.web:gs-web-app org.geoserver:gs-main org.geoserver.web:gs-web-app Maven
  • Medium 4.5
    CVE-2024-34696

    GeoServer's Server Status shows sensitive environmental variables and Java properties

    GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any …

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-main Maven
  • Medium 4.8
    CVE-2024-23640

    GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher

    GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.0 that enables an authenticated administrator with w…

    geoserver geoserver org.geoserver:gs-main org.geoserver:gs-ows Maven
  • High 7.2
    CVE-2023-41877

    GeoServer log file path traversal vulnerability

    GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the …

    geoserver geoserver org.geoserver:gs-main Maven
  • High 7.5
    CVE-2021-40822 Public exploit Scanner template EPSS 19%

    GeoServer allows SSRF via the option for setting a proxy host

    GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

    org.geoserver:gs-main Maven
  • High 7.2
    CVE-2022-24847

    Improper Input Validation in GeoServer

    GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in ar…

    geoserver geoserver org.geoserver:gs-main Maven