{"action":"Upgrade org.geoserver:gs-ows to 2.23.3 or later.","affected":[{"fixed":"2.23.3","introduced":"0"}],"component":"org.geoserver:gs-ows","cve_ids":["CVE-2024-23640"],"ecosystem":"Maven","epss":0.00426,"exploited":false,"fixed_versions":["2.23.3"],"ghsa_id":"GHSA-9rfr-pf2x-g4xf","id":"tcs_01M5N8QN8XGQKB91SV3RAW1MJN","modified_at":"2026-09-10T03:50:10.418884566Z","published_at":"2024-03-20T15:06:03Z","references":["https://osv.dev/vulnerability/GHSA-9rfr-pf2x-g4xf","https://github.com/geoserver/geoserver/security/advisories/GHSA-9rfr-pf2x-g4xf","https://nvd.nist.gov/vuln/detail/CVE-2024-23640","https://github.com/geoserver/geoserver/pull/7162","https://github.com/geoserver/geoserver/pull/7181","https://github.com/geoserver/geoserver","https://osgeo-org.atlassian.net/browse/GEOS-11149","https://osgeo-org.atlassian.net/browse/GEOS-11155"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-9rfr-pf2x-g4xf#Maven/org.geoserver:gs-ows","url":"https://osv.dev/vulnerability/GHSA-9rfr-pf2x-g4xf"}],"summary":"GeoServer's Style Publisher vulnerable to Stored Cross-Site Scripting (XSS)"}