{"action":"Upgrade org.geoserver.web:gs-web-app to 2.25.0 or later.","affected":[{"fixed":"2.25.0","introduced":"0"}],"component":"org.geoserver.web:gs-web-app","cve_ids":["CVE-2024-34711"],"ecosystem":"Maven","epss":0.00298,"exploited":false,"fixed_versions":["2.25.0"],"ghsa_id":"GHSA-mc43-4fqr-c965","id":"tcs_01M5N94VEFVWMW4JVKXV7DN3NS","modified_at":"2025-06-10T15:35:23Z","published_at":"2025-06-10T14:13:44Z","references":["https://osv.dev/vulnerability/GHSA-mc43-4fqr-c965","https://github.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965","https://nvd.nist.gov/vuln/detail/CVE-2024-34711","https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities","https://github.com/geoserver/geoserver"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-mc43-4fqr-c965","url":"https://osv.dev/vulnerability/GHSA-mc43-4fqr-c965"}],"summary":"GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)"}