{"id":"CVE-2024-35230","aliases":["GHSA-6pfc-w86r-54q6"],"url":"https://o3.security/vulnerability/CVE-2024-35230","summary":"Welcome and About GeoServer pages communicate version and revision information","details":"### Impact\n\nThe welcome and about page includes version and revision information about the software in use (including library and components used).\n\nThis information is sensitive from a security point of view because it allows software used by the server to be easily identified.\n\n### Proof of Concept\n\n1. Welcome page footer: \n   \n   <img width=\"432\" alt=\"image\" src=\"https://github.com/geoserver/geoserver/assets/629681/a7fd5151-55d5-432b-9d5d-79136833609f\">\n\n2. About page *build information*. \n\n   <img width=\"401\" alt=\"image\" src=\"https://github.com/geoserver/geoserver/assets/629681/59fcd8dd-eaee-4bf8-9578-a2a94b2864db\">\n\n### Patches\n\nNo patch presently available.\n\n### Workarounds\n\nNo workaround available, although the ADMIN_CONSOLE can be disabled completely.\n\n### References\n\n* [About GeoServer](https://docs.geoserver.org/latest/en/user/webadmin/about.html)\n","published":"2024-12-16T22:18:19.896Z","modified":"2026-08-12T15:16:00.426381Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.geoserver.web:gs-web-app","fixedVersion":"2.25.1"},{"ecosystem":"Maven","name":"org.geoserver.web:gs-web-core","fixedVersion":"2.25.1"}],"fix":{"url":"https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8","label":"geoserver/geoserver@74fdab7"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35230.json"},{"type":"ADVISORY","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-6pfc-w86r-54q6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35230"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/8cd1590a604a10875de67b04995f1952f631f920"},{"type":"WEB","url":"https://github.com/geoserver/geoserver/commit/5fd5f35ae176eff3cc4667a5cf48e4bf5dc4ea99"},{"type":"PACKAGE","url":"https://github.com/geoserver/geoserver"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:16:00.426381Z"}}