References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Change History

GitHub, Inc. AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

GitHub, Inc. CWE-79

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap OpenLayers Output Format.  Access to the WMS OpenLayers Format is avail

GitHub, Inc. https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2 [No types assigned]

GitHub, Inc. https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6f [No types assigned]

GitHub, Inc. https://github.com/geoserver/geoserver/pull/7174 [No types assigned]

GitHub, Inc. https://github.com/geoserver/geoserver/security/advisories/GHSA-fcpm-hchj-mh72 [No types assigned]

GitHub, Inc. https://osgeo-org.atlassian.net/browse/GEOS-11153 [No types assigned]