Read the docs
TI-2024-22995 Aliases CVE-2024-34696GHSA-j59v-vgcr-hxvf

GeoServer's Server Status shows sensitive environmental variables and Java properties

Priority LOW 23CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any GeoServer user with administrative rights as part of those modules' status message. These variables/properties can also contain sensitive information, such as database passwords or API keys/tokens. Additionally, many community-developed GeoServer container images `export` other credentials from their start-up scripts as environment variables to the GeoServer (`java`) process. The precise scope of the issue depends on which container image is used and how it is configured. The `about status` API endpoint which powers the Server Status page is only available to administrators.Depending on the operating environment, administrators might have legitimate access to credentials in other ways, but this issue defeats more sophisticated controls (like break-glass access to secrets or role accounts).By default, GeoServer only allows same-origin authenticated API access. This limits the scope for a third-party attacker to use an administrator’s credentials to gain access to credentials. The researchers who found the vulnerability were unable to determine any other conditions under which the GeoServer REST API may be available more broadly. Users should update container images to use GeoServer 2.24.4 or 2.25.1 to get the bug fix. As a workaround, leave environment variables and Java system properties hidden by default. Those who provide the option to re-enable it should communicate the impact and risks so that users can make an informed choice.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed geoserver (geoserver): 2.24.4, 2.25.1org.geoserver.web:gs-web-app (Maven): 2.24.4, 2.25.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
geoservergeoserver2.10.0 to before 2.24.4; 2.25.0 to before 2.25.12.24.4, 2.25.1Patch availableCNA
—org.geoserver.web:gs-web-app (Maven)2.10.0 to before 2.24.42.24.4Patch availableGHSA-j59v-vgcr-hxvf
—org.geoserver.web:gs-web-app (Maven)2.25.0 to before 2.25.12.25.1Patch availableGHSA-j59v-vgcr-hxvf
—org.geoserver:gs-main (Maven)2.10.0 to before 2.24.42.24.4Patch availableGHSA-j59v-vgcr-hxvf
—org.geoserver:gs-main (Maven)2.25.0 to before 2.25.12.25.1Patch availableGHSA-j59v-vgcr-hxvf
  • geoserver Vendorgeoserver Affected 2.10.0 to before 2.24.4; 2.25.0 to before 2.25.1 Fixed in 2.24.4, 2.25.1 Patch available CNA
  • org.geoserver.web:gs-web-app (Maven) Vendor— Affected 2.10.0 to before 2.24.4 Fixed in 2.24.4 Patch available GHSA-j59v-vgcr-hxvf
  • org.geoserver.web:gs-web-app (Maven) Vendor— Affected 2.25.0 to before 2.25.1 Fixed in 2.25.1 Patch available GHSA-j59v-vgcr-hxvf
  • org.geoserver:gs-main (Maven) Vendor— Affected 2.10.0 to before 2.24.4 Fixed in 2.24.4 Patch available GHSA-j59v-vgcr-hxvf
  • org.geoserver:gs-main (Maven) Vendor— Affected 2.25.0 to before 2.25.1 Fixed in 2.25.1 Patch available GHSA-j59v-vgcr-hxvf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*2.10.0 to before 2.24.4; 2.25.0 to before 2.25.1Vulnerablegeoserver
  • cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:* Versions 2.10.0 to before 2.24.4; 2.25.0 to before 2.25.1 Vulnerable ·geoserver

Remediation

  • Fix · CNA geoserver (geoserver) Fixed in 2.24.4, 2.25.1
  • Fix · GHSA-j59v-vgcr-hxvf org.geoserver.web:gs-web-app (Maven) Fixed in 2.24.4 Advisory →
  • Fix · GHSA-j59v-vgcr-hxvf org.geoserver.web:gs-web-app (Maven) Fixed in 2.25.1 Advisory →
  • Fix · GHSA-j59v-vgcr-hxvf org.geoserver:gs-main (Maven) Fixed in 2.24.4 Advisory →
  • Fix · GHSA-j59v-vgcr-hxvf org.geoserver:gs-main (Maven) Fixed in 2.25.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-34696
  2. 2026-10-03 Alias added: GHSA-j59v-vgcr-hxvf

References

Advisory 2

Other 1

  • TI-2024-24187 Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36149 GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17518 GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code… CVSS 3.1CRITICAL 9.8
  • TI-2023-28098 GeoServer arbitrary file upload vulnerability in REST Coverage Store API CVSS 3.1HIGH 7.2
  • TI-2024-15662 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form CVSS 3.1MEDIUM 4.8
  • TI-2023-28099 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API CVSS 3.1MEDIUM 4.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences