GHSA-6pfc-w86r-54q6MediumCVSS 5.3

Welcome and About GeoServer pages communicate version and revision information

Published
December 16, 2024
Last Modified
December 17, 2024

🔗 CVE IDs covered (1)

CVE-2024-35230 →

📋 Description

Impact

The welcome and about page includes version and revision information about the software in use (including library and components used).

This information is sensitive from a security point of view because it allows software used by the server to be easily identified.

Proof of Concept

  1. Welcome page footer:

  2. About page build information.

Patches

No patch presently available.

Workarounds

No workaround available, although the ADMIN_CONSOLE can be disabled completely.

References

🎯 Affected products2

  • maven/org.geoserver.web:gs-web-app:>= 2.0.0, < 2.25.1
  • maven/org.geoserver.web:gs-web-core:>= 2.0.0, < 2.25.1

🔗 References (6)