Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-35230

CVE-2024-35230:
Welcome and About GeoServer pages communicate version and revision information

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-35230
GHSA ID
GHSA-6pfc-w86r-54q6
EPSS Score
0.14667%
CWE
CWE-200
Published
12/16/2024
Updated
12/17/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.geoserver.web:gs-web-appmaven>= 2.0.0, < 2.25.12.25.1
org.geoserver.web:gs-web-coremaven>= 2.0.0, < 2.25.12.25.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability manifests in two UI components: 1) The welcome page footer (GeoServerHomePage) displayed version information to all users without authentication checks. 2) The About page (AboutGeoServerPage) constructor added version/revision labels without authorization checks. Commit 74fdab7 shows the footerMessage() was modified to hide version info from non-admins, and commit 8cd1590 reveals the About page build info was wrapped in admin-only visibility checks. The vulnerable versions lacked these protections, making these functions the exposure points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** w*l*om* *n* **out p*** in*lu**s v*rsion *n* r*vision in*orm*tion **out t** so*tw*r* in us* (in*lu*in* li*r*ry *n* *ompon*nts us**). T*is in*orm*tion is s*nsitiv* *rom * s**urity point o* vi*w ****us* it *llows so*tw*r* us** *y t** s*

Reasoning

T** vuln*r**ility m*ni**sts in two UI *ompon*nts: *) T** w*l*om* p*** *oot*r (`**oS*rv*r*om*P***`) *ispl*y** v*rsion in*orm*tion to *ll us*rs wit*out *ut**nti**tion ****ks. *) T** **out p*** (`**out**oS*rv*rP***`) *onstru*tor ***** v*rsion/r*vision l