GHSA-jm79-7xhw-6f6f

Suggest an improvement
Source
https://github.com/advisories/GHSA-jm79-7xhw-6f6f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-jm79-7xhw-6f6f/GHSA-jm79-7xhw-6f6f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jm79-7xhw-6f6f
Aliases
Published
2025-06-10T14:14:08Z
Modified
2025-06-10T15:35:27Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
GWC Home Page communicate version and revision information
Details

Summary

The GeoWebCache home page includes version and revision information about the software in use. This information is sensitive from a security point of view because it allows software used by the server to be easily identified.

Details

org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations.

PoC

Just open http://localhost:8080/geoserver/gwc/

Impact

In addition to exposing the version and revision information, the home page will expose the config file and storage locations which may expose the system's temp directory location and whether or not GeoServer is running in a Windows operating system. The approximate server start time and some basic GWC usage information is also exposed.

References

https://osgeo-org.atlassian.net/browse/GEOS-11677 https://github.com/geoserver/geoserver/pull/8189 https://github.com/GeoWebCache/geowebcache/issues/1344 https://github.com/GeoWebCache/geowebcache/pull/1345

Database specific 
{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-06-10T14:14:08Z",
    "nvd_published_at":  "2025-06-10T15:15:22Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.geoserver.web:gs-web-app

Package

Name
org.geoserver.web:gs-web-app
View open source insights on deps.dev
Purl
pkg:maven/org.geoserver.web/gs-web-app

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.26.0
Fixed
2.26.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-jm79-7xhw-6f6f/GHSA-jm79-7xhw-6f6f.json"

Maven / org.geoserver.web:gs-web-app

Package

Name
org.geoserver.web:gs-web-app
View open source insights on deps.dev
Purl
pkg:maven/org.geoserver.web/gs-web-app

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.25.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-jm79-7xhw-6f6f/GHSA-jm79-7xhw-6f6f.json"

Maven / org.geoserver:gs-gwc

Package

Name
org.geoserver:gs-gwc
View open source insights on deps.dev
Purl
pkg:maven/org.geoserver/gs-gwc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.26.0
Fixed
2.26.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-jm79-7xhw-6f6f/GHSA-jm79-7xhw-6f6f.json"

Maven / org.geoserver:gs-gwc

Package

Name
org.geoserver:gs-gwc
View open source insights on deps.dev
Purl
pkg:maven/org.geoserver/gs-gwc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.25.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-jm79-7xhw-6f6f/GHSA-jm79-7xhw-6f6f.json"