High severity · published Jun 10, 2025
CVE-2024-38524
GeoServer is an open source server that allows users to share and edit geospatial data
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations. This vulnerability is fixed in 2.26.2 and 2.25.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geoserver · Osgeo
before 2.25.6; 2.26.0 before 2.26.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38524
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38524
Issue Tracking
https://github.com/GeoWebCache/geowebcache/issues/1344
Patch
https://github.com/GeoWebCache/geowebcache/pull/1345
Patch
https://github.com/geoserver/geoserver/pull/8189
Exploit
https://github.com/geoserver/geoserver/security/advisories/GHSA-jm79-7xhw-6f6f
Issue Tracking
https://osgeo-org.atlassian.net/browse/GEOS-11677
More from Geoserver
9.8
CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
9.8
CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
9.8
CVE-2023-43795
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data
9.8
CVE-2023-25157
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data
9.1
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data