CVE-2024-23821 - CVE House
Back to Database
Status published Medium CVE-2024-23821

GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)

Vulnerability Description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the GWC Demos Page. Access to the GWC Demos Page is available to all users although data security may limit users' ability to trigger the XSS. Versions 2.23.4 and 2.24.1 contain a patch for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-23821

Credits & Attribution

No credits recorded in the NVD database.

References

More from geoserver

View All →
CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
High 8.2
CVE-2025-58175
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
Medium 6.5
CVE-2025-52465
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
High 7.2
CVE-2025-30220
GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Critical 9.9
CVE-2025-30145
GeoServer has an Infinite Loop Vulnerability in Jiffle process
High 7.5

Affected Vendor

Affected Software

geoserver
Vulnerable Versions:
< 2.23.4, = 2.24.0

Timeline

Official Publish: March 20th, 2024
Last Modified: April 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact