{"action":"Upgrade org.geoserver:gs-wms to 2.23.3 (2.23.x) or 2.24.1 (2.24.x) or later.","affected":[{"fixed":"2.23.3","introduced":"0"},{"fixed":"2.24.1","introduced":"2.24.0"}],"component":"org.geoserver:gs-wms","cve_ids":["CVE-2024-23818"],"ecosystem":"Maven","epss":0.00426,"exploited":false,"fixed_versions":["2.23.3","2.24.1"],"ghsa_id":"GHSA-fcpm-hchj-mh72","id":"tcs_01M5N8VRYMB0JCPN6E6X8E38XQ","modified_at":"2026-09-10T03:50:10.590621033Z","published_at":"2024-03-20T15:15:17Z","references":["https://osv.dev/vulnerability/GHSA-fcpm-hchj-mh72","https://github.com/geoserver/geoserver/security/advisories/GHSA-fcpm-hchj-mh72","https://nvd.nist.gov/vuln/detail/CVE-2024-23818","https://github.com/geoserver/geoserver/pull/7174","https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2","https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6f","https://github.com/geoserver/geoserver","https://osgeo-org.atlassian.net/browse/GEOS-11153"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-fcpm-hchj-mh72","url":"https://osv.dev/vulnerability/GHSA-fcpm-hchj-mh72"}],"summary":"GeoServer's WMS OpenLayers Format vulnerable to Stored Cross-Site Scripting (XSS)"}