Security
فارسی
All products

org.geoserver.web:gs-web-app

Maven · Package
16 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Welcome and About GeoServer pages communicate version and revision informationCVE-2024-35230 · GHSA-6PFC-W86R-54Q6 org.geoserver.web:gs-web-apporg.geoserver.web:gs-web-core Maven Medium Fix reported
GeoServer's Server Status shows sensitive environmental variables and Java propertiesCVE-2024-34696 · GHSA-J59V-VGCR-HXVF org.geoserver.web:gs-web-apporg.geoserver:gs-main Maven Medium Fix reported
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templatesCVE-2024-45747 · GHSA-WF6J-GR27-G7CH org.geoserver.web:gs-web-apporg.geoserver:gs-main Maven High Fix reported
GeoServer has an arbitrary file write vulnerability in its Master Password Dump PageCVE-2025-52465 · GHSA-7QMG-GRCP-QF25 org.geoserver.web:gs-web-apporg.geoserver.web:gs-web-sec-core Maven High Fix reported
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity ResolutionCVE-2025-58175 · GHSA-X4R9-GMW3-HXWW org.geoserver.web:gs-web-apporg.geoserver:gs-main Maven Medium Fix reported
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS ServiceCVE-2025-30220 · GHSA-JJ54-8F66-C5PC org.geoserver.web:gs-web-apporg.geoserver:gs-wfs Maven High Fix reported
Remote Code Execution (RCE) vulnerability in geoserverCVE-2024-36401 · GHSA-6JJ6-GM7P-FCVV org.geoserver.web:gs-web-apporg.geoserver:gs-wfs Maven Critical Fix reported
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap featureCVE-2025-58360 · GHSA-FJF5-XGMQ-5525 org.geoserver.web:gs-web-apporg.geoserver:gs-wms Maven High Fix reported
GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML formatCVE-2025-21621 · GHSA-W66H-J855-QR72 org.geoserver.web:gs-web-apporg.geoserver:gs-wms Maven Medium Fix reported
Classpath resource disclosure in GWC Web Resource API on Windows / TomcatCVE-2024-24749 · GHSA-JHQX-5V5G-MPF3 org.geoserver.web:gs-web-apporg.geoserver:gs-gwc Maven High Fix reported
GeoServer Infinite Loop Vulnerability in Jiffle processCVE-2025-30145 · GHSA-GR67-PWCV-76GF org.geoserver.extension:gs-wps-coreorg.geoserver.web:gs-web-app Maven High Fix reported
GeoServer Missing Authorization on REST API IndexCVE-2025-27505 · GHSA-H86G-X8MM-78M5 org.geoserver.web:gs-web-apporg.geoserver:gs-rest Maven Medium Fix reported
Coverage REST API Server Side Request ForgeryCVE-2024-40625 · GHSA-R4HF-R8GJ-JGW2 org.geoserver.web:gs-web-apporg.geoserver:gs-rest Maven Medium Fix reported
GWC Home Page communicate version and revision informationCVE-2024-38524 · GHSA-JM79-7XHW-6F6F org.geoserver.web:gs-web-apporg.geoserver:gs-gwc Maven Medium Fix reported
GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)CVE-2024-34711 · GHSA-MC43-4FQR-C965 org.geoserver.main:gs-mainorg.geoserver.web:gs-web-app Maven Critical Fix reported
Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRFCVE-2023-41339 · GHSA-CQPC-X2C6-2GMF org.geoserver.web:gs-web-apporg.geoserver:gs-wms Maven Medium Fix reported