Skip to content
OpenAdvisories

Package · Maven

org.geoserver.web:gs-web-app

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-58175

    GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

    GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). …

    geoserver org.geoserver.web:gs-web-app org.geoserver:gs-main org.geoserver.web:gs-web-app Maven
  • Medium 6.1
    CVE-2025-21621

    GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format

    GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting (XSS) vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
  • Medium 5.3
    CVE-2025-27505 Scanner template

    GeoServer Missing Authorization on REST API Index

    GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g.,…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-rest Maven
  • Medium 5.5
    CVE-2024-40625

    GeoServer Coverage REST API Allows Server Side Request Forgery

    GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals …

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-rest Maven
  • Medium 5.3
    CVE-2024-38524

    GWC Home Page communicate version and revision information

    GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-gwc Maven
  • Medium 5.3
    CVE-2024-35230

    Welcome and About GeoServer pages communicate version and revision information

    GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about page includes version and revision information about the software in use (including library and compone…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver.web:gs-web-core Maven
  • Medium 4.5
    CVE-2024-34696

    GeoServer's Server Status shows sensitive environmental variables and Java properties

    GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any …

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-main Maven