org.geoserver:gs-wms (Maven)
Advisories
18
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.27.0 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.geoserver</groupId><artifactId>gs-wms</artifactId><version>2.27.0</version></dependency>gradle
implementation("org.geoserver:gs-wms:2.27.0")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-wf6j-gr27-g7ch GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates |
High | < 2.27.0 | 2.27.0 |
| GHSA-fjf5-xgmq-5525 GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature Known exploited |
Critical EPSS 61.17% |
>= 2.26.0, < 2.26.2 | 2.26.2 |
| GHSA-fjf5-xgmq-5525 GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature Known exploited |
Critical EPSS 61.17% |
< 2.25.6 | 2.25.6 |
| GHSA-fjf5-xgmq-5525 GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature Known exploited |
Critical EPSS 61.17% |
>= 2.26.0, < 2.26.2 | 2.26.2 |
| GHSA-fjf5-xgmq-5525 GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature Known exploited |
Critical EPSS 61.17% |
< 2.25.6 | 2.25.6 |
| GHSA-w66h-j855-qr72 GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format |
Medium EPSS 0.32% |
< 2.25.0 | 2.25.0 |
| GHSA-gr67-pwcv-76gf GeoServer Infinite Loop Vulnerability in Jiffle process |
High EPSS 0.51% |
< 2.25.7 | 2.25.7 |
| GHSA-gr67-pwcv-76gf GeoServer Infinite Loop Vulnerability in Jiffle process |
High EPSS 0.51% |
>= 2.26.0, < 2.26.3 | 2.26.3 |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver Known exploited |
Critical EPSS 99.81% |
< 2.22.6 | 2.22.6 |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver Known exploited |
Critical EPSS 99.81% |
>= 2.23.0, < 2.23.6 | 2.23.6 |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver Known exploited |
Critical EPSS 99.81% |
< 2.22.6 | 2.22.6 |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver Known exploited |
Critical EPSS 99.81% |
>= 2.24.0, < 2.24.4 | 2.24.4 |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver Known exploited |
Critical EPSS 99.81% |
>= 2.25.0, < 2.25.2 | 2.25.2 |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver Known exploited |
Critical EPSS 99.81% |
>= 2.24.0, < 2.24.4 | 2.24.4 |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver Known exploited |
Critical EPSS 99.81% |
>= 2.25.0, < 2.25.2 | 2.25.2 |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver Known exploited |
Critical EPSS 99.81% |
>= 2.23.0, < 2.23.6 | 2.23.6 |
| GHSA-cqpc-x2c6-2gmf Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF |
Medium EPSS 0.63% |
< 2.22.5 | 2.22.5 |
| GHSA-cqpc-x2c6-2gmf Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF |
Medium EPSS 0.63% |
>= 2.23.0, < 2.23.2 | 2.23.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor