CVE-2023-51445

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.0 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources that will execute in the context of another administrator's browser when viewed in the REST Resources API. Access to the REST Resources API is limited to full administrators by default and granting non-administrators access to this endpoint should be carefully considered as it may allow access to files containing sensitive information. Versions 2.23.3 and 2.24.0 contain a patch for this issue.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad	Patch
https://github.com/geoserver/geoserver/pull/7161	Issue Tracking
https://github.com/geoserver/geoserver/security/advisories/GHSA-fh7p-5f6g-vj2w	Exploit Vendor Advisory
https://osgeo-org.atlassian.net/browse/GEOS-11148	Issue Tracking
https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad	Patch
https://github.com/geoserver/geoserver/pull/7161	Issue Tracking
https://github.com/geoserver/geoserver/security/advisories/GHSA-fh7p-5f6g-vj2w	Exploit Vendor Advisory
https://osgeo-org.atlassian.net/browse/GEOS-11148	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-03-20 16:15

Updated : 2024-12-18 21:56

NVD link : CVE-2023-51445

Mitre link : CVE-2023-51445

CVE.ORG link : CVE-2023-51445

JSON object : View

Products Affected

geoserver

geoserver

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-51445", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2024-03-20T16:15:07.640", "references": [{"url": "https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/geoserver/geoserver/pull/7161", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-fh7p-5f6g-vj2w", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://osgeo-org.atlassian.net/browse/GEOS-11148", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/geoserver/geoserver/pull/7161", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-fh7p-5f6g-vj2w", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://osgeo-org.atlassian.net/browse/GEOS-11148", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.0 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources that will execute in the context of another administrator's browser when viewed in the REST Resources API. Access to the REST Resources API is limited to full administrators by default and granting non-administrators access to this endpoint should be carefully considered as it may allow access to files containing sensitive information. Versions 2.23.3 and 2.24.0 contain a patch for this issue."}, {"lang": "es", "value": "GeoServer es un servidor de software de c\u00f3digo abierto escrito en Java que permite a los usuarios compartir y editar datos geoespaciales. Existe una vulnerabilidad de Cross Site Scripting (XSS) almacenado en versiones anteriores a 2.23.3 y 2.24.0 que permite a un administrador autenticado con privilegios a nivel de espacio de trabajo almacenar un payload de JavaScript en recursos de estilo/leyenda cargados que se ejecutar\u00e1n en el contexto del navegador de otro administrador cuando se visualicen en la API de recursos REST. El acceso a la API de recursos REST est\u00e1 limitado a administradores completos de forma predeterminada y se debe considerar cuidadosamente la concesi\u00f3n de acceso a este endpoint a personas que no sean administradores, ya que puede permitir el acceso a archivos que contienen informaci\u00f3n confidencial. Las versiones 2.23.3 y 2.24.0 contienen un parche para este problema."}], "lastModified": "2024-12-18T21:56:24.053", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76D6CFB3-1A7B-4436-B927-6455629A0062", "versionEndExcluding": "2.23.3"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}