{"action":"Upgrade org.geoserver:gs-wms to 2.23.4 (2.23.x) or 2.24.1 (2.24.x) or later.","affected":[{"fixed":"2.23.4","introduced":"0"},{"fixed":"2.24.1","introduced":"2.24.0"}],"component":"org.geoserver:gs-wms","cve_ids":["CVE-2024-23642"],"ecosystem":"Maven","epss":0.00426,"exploited":false,"fixed_versions":["2.23.4","2.24.1"],"ghsa_id":"GHSA-fg9v-56hw-g525","id":"tcs_01M5N8VZ6TCD7HM76F937V5B43","modified_at":"2026-09-10T03:50:10.521588420Z","published_at":"2024-03-20T15:08:29Z","references":["https://osv.dev/vulnerability/GHSA-fg9v-56hw-g525","https://github.com/geoserver/geoserver/security/advisories/GHSA-fg9v-56hw-g525","https://nvd.nist.gov/vuln/detail/CVE-2024-23642","https://github.com/geoserver/geoserver/pull/7173","https://github.com/geoserver/geoserver/commit/1b1835afbb9c282d1840786259aeda81c1d22b00","https://github.com/geoserver/geoserver/commit/9f40265febb5939f23e2c53930c9c35e93970afe","https://github.com/geoserver/geoserver","https://osgeo-org.atlassian.net/browse/GEOS-11152"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-fg9v-56hw-g525","url":"https://osv.dev/vulnerability/GHSA-fg9v-56hw-g525"}],"summary":"GeoServer's Simple SVG Renderer vulnerable to Stored Cross-Site Scripting (XSS)"}