CVE-2024-35230: Welcome and About GeoServer pages communicate version and revision information
Impact
The welcome and about page includes version and revision information about the software in use (including library and components used).
This information is sensitive from a security point of view because it allows software used by the server to be easily identified.
Proof of Concept
1. Welcome page footer: <img width="432" alt="image" src="https://github.com/geoserver/geoserver/assets/629681/a7fd5151-55d5-432b-9d5d-79136833609f">
2. About page build information.
<img width="401" alt="image" src="https://github.com/geoserver/geoserver/assets/629681/59fcd8dd-eaee-4bf8-9578-a2a94b2864db">
Patches
No patch presently available.
Workarounds
No workaround available, although the ADMINCONSOLE can be disabled completely.
References
About GeoServer
Other sources
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about page includes version and revision information about the software in use (including library and components used). This information is sensitive from a security point of view because it allows software used by the server to be easily identified. This issue has been patched in version 2.26.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35230?
The severity of CVE-2024-35230 is considered moderate due to the exposure of sensitive version information.
How do I fix CVE-2024-35230?
To fix CVE-2024-35230, upgrade to version 2.25.1 of the affected GeoServer components.
What components are affected by CVE-2024-35230?
CVE-2024-35230 affects the GeoServer components 'gs-web-core' and 'gs-web-app' between versions 2.0.0 and 2.25.1.
What is the impact of CVE-2024-35230?
The impact of CVE-2024-35230 is that sensitive version and revision information can be exploited to identify software components used by the server.
Are there any mitigation strategies for CVE-2024-35230?
Mitigation for CVE-2024-35230 includes restricting access to the welcome and about pages to trusted users.