Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-wf6j-gr27-g7ch
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-main
  • Maven/org.geoserver:gs-wms
 GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates 19 Aug
  • Fix available
  • Severity - 7.2 (High)
GHSA-x4r9-gmw3-hxww
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-main
 GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution 12 Jun
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-7qmg-grcp-qf25
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver.web:gs-web-sec-core
 GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page 12 Jun
  • Fix available
  • Severity - 7.2 (High)
GHSA-fjf5-xgmq-5525
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-wms
 GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature 25 Nov 2025
  • Fix available
  • Severity - 8.2 (High)
GHSA-w66h-j855-qr72
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-wms
 GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format 25 Nov 2025
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-jj54-8f66-c5pc
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-wfs
 [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service 10 Jun 2025
  • Fix available
  • Severity - 8.2 (High)
GHSA-gr67-pwcv-76gf
  • Maven/org.geoserver.extension:gs-wps-core
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-wms
 GeoServer Infinite Loop Vulnerability in Jiffle process 10 Jun 2025
  • Fix available
  • Severity - 7.5 (High)
GHSA-h86g-x8mm-78m5
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-rest
 GeoServer Missing Authorization on REST API Index 10 Jun 2025
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-r4hf-r8gj-jgw2
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-rest
 Coverage REST API Server Side Request Forgery 10 Jun 2025
  • Fix available
  • Severity - 5.5 (Medium)
GHSA-jm79-7xhw-6f6f
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-gwc
 GWC Home Page communicate version and revision information 10 Jun 2025
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-mc43-4fqr-c965
  • Maven/org.geoserver.main:gs-main
  • Maven/org.geoserver.web:gs-web-app
 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) 10 Jun 2025
  • Fix available
  • Severity - 9.3 (Critical)
GHSA-6pfc-w86r-54q6
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver.web:gs-web-core
 Welcome and About GeoServer pages communicate version and revision information 16 Dec 2024
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-6jj6-gm7p-fcvv
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-wfs
  • Maven/org.geoserver:gs-wms
 Remote Code Execution (RCE) vulnerability in geoserver 01 Jul 2024
  • Fix available
  • Severity - 9.3 (Critical)
GHSA-jhqx-5v5g-mpf3
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-gwc
 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat 01 Jul 2024
  • Fix available
  • Severity - 7.5 (High)
GHSA-j59v-vgcr-hxvf
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-main
 GeoServer's Server Status shows sensitive environmental variables and Java properties 01 Jul 2024
  • Fix available
  • Severity - 4.5 (Medium)
GHSA-cqpc-x2c6-2gmf
  • Maven/org.geoserver.web:gs-web-app
  • Maven/org.geoserver:gs-wms
 Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF 24 Oct 2023
  • Fix available
  • Severity - 5.3 (Medium)