{"action":"Upgrade org.geoserver.extension:gs-mapml to 2.23.4 (2.23.x) or 2.24.1 (2.24.x) or later.","affected":[{"fixed":"2.23.4","introduced":"0"},{"fixed":"2.24.1","introduced":"2.24.0"}],"component":"org.geoserver.extension:gs-mapml","cve_ids":["CVE-2024-23819"],"ecosystem":"Maven","epss":0.00426,"exploited":false,"fixed_versions":["2.23.4","2.24.1"],"ghsa_id":"GHSA-7x76-57fr-m5r5","id":"tcs_01M5N8KCZP5PMJYMC9J3P6D54M","modified_at":"2026-09-10T03:50:00.317555858Z","published_at":"2024-03-20T15:16:53Z","references":["https://osv.dev/vulnerability/GHSA-7x76-57fr-m5r5","https://github.com/geoserver/geoserver/security/advisories/GHSA-7x76-57fr-m5r5","https://nvd.nist.gov/vuln/detail/CVE-2024-23819","https://github.com/geoserver/geoserver/pull/7175","https://github.com/geoserver/geoserver/commit/6f04adbdc6c289f5cb815b1462a6bd790e3fb6ef","https://github.com/geoserver/geoserver/commit/df65ff05250cbb498c78af906d66e0c084ace8a1","https://github.com/geoserver/geoserver","https://osgeo-org.atlassian.net/browse/GEOS-11154"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-7x76-57fr-m5r5","url":"https://osv.dev/vulnerability/GHSA-7x76-57fr-m5r5"}],"summary":"GeoServer's MapML HTML Page vulnerable to Stored Cross-Site Scripting (XSS)"}