CVE-2024-38524

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations. This vulnerability is fixed in 2.26.2 and 2.25.6.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
geoserver	geoserver	>= 2.26.0, < 2.26.2; < 2.25.6

References

https://github.com/GeoWebCache/geowebcache/issues/1344Issue Tracking
https://github.com/GeoWebCache/geowebcache/pull/1345Patch
https://github.com/geoserver/geoserver/pull/8189Patch
https://github.com/geoserver/geoserver/security/advisories/GHSA-jm79-7xhw-6f6fExploit, Third Party Advisory
https://osgeo-org.atlassian.net/browse/GEOS-11677Issue Tracking, Patch

Timeline

Published: Jun 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-385257.5dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs t CVE-2024-385267.2pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.CVE-2024-385275.4ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and m CVE-2024-385287.5nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS CVE-2024-385298.8Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a CVE-2024-38537.5A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started. This vulnerab CVE-2024-385309.8The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in CVE-2024-385313.6Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has acces CVE-2024-385327.1The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine fo CVE-2024-385336.5ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. There is possible invalid stack access due to the addresse CVE-2024-385347.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic CVE-2024-385357.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Suricata can run out o