| Package | Affected versions | Patched versions |
|---|---|---|
| org.geoserver.web:gs-web-app | ≥ 2.0.0, < 2.25.1 | 2.25.1 |
| org.geoserver.web:gs-web-core | ≥ 2.0.0, < 2.25.1 | 2.25.1 |
| geoserver | ≥ 2.0.0, < 2.25.1 | 2.25.1 |
The welcome and about page includes version and revision information about the software in use (including library and components used).
This information is sensitive from a security point of view because it allows software used by the server to be easily identified.
Welcome page footer:
<img width="432" alt="image" src="https://github.com/geoserver/geoserver/assets/629681/a7fd5151-55d5-432b-9d5d-79136833609f">About page build information.
<img width="401" alt="image" src="https://github.com/geoserver/geoserver/assets/629681/59fcd8dd-eaee-4bf8-9578-a2a94b2864db">No patch presently available.
No workaround available, although the ADMIN_CONSOLE can be disabled completely.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free