バナーによると、リモートホストで実行している GeoServer のバージョンは、2.23.3 より前です。したがって、以下の複数の脆弱性による影響を受けます。

- Style Publisher での格納型クロスサイトスクリプティング (XSS) の脆弱性 - REST Resources API での格納型クロスサイトスクリプティング (XSS) の脆弱性

スキャナーはこれらの問題のテストを行っておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

根據其標題，遠端主機上執行的 GeoServer 為 2.23.3 版之前的版本。因此，會受到多個弱點影響：

- Style Publisher 中的儲存型跨網站指令碼 (XSS) 弱點 - REST 資源 API 中的儲存型跨網站指令碼 (XSS) 弱點

請注意，掃描器程式並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

根据其标题，远程主机上运行的 GeoServer 版本低于 2.23.3。因此，该软件受到多个漏洞的影响：

- Style Publisher 中存在存储型跨站脚本 (XSS) 漏洞 - REST Resources API 中存在存储型跨站脚本 (XSS) 漏洞

请注意，扫描程序并未测试这些问题，而是仅依据应用程序自我报告的版本号进行判断。

According to its banner, the version of GeoServer running on the remote host is prior to 2.23.3. It is, therefore, affected by Multiples Vulnerabilities :

- A Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher - A Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GeoServer is an open source software server written in Java that allows users to share and edit geospatial
    data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.0 that
    enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in
    uploaded style/legend resources that will execute in the context of another administrator's browser when
    viewed in the REST Resources API. Access to the REST Resources API is limited to full administrators by
    default and granting non-administrators access to this endpoint should be carefully considered as it may
    allow access to files containing sensitive information. Versions 2.23.3 and 2.24.0 contain a patch for
    this issue. (CVE-2023-51445)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
114537	GeoServer < 2.23.3 の複数の脆弱性	Web App Scanning	Component Vulnerability	2024/12/10	2024/12/10	medium
114537	GeoServer < 2.23.3 多個弱點	Web App Scanning	Component Vulnerability	2024/12/10	2024/12/10	medium
114537	GeoServer < 2.23.3 多个漏洞	Web App Scanning	Component Vulnerability	2024/12/10	2024/12/10	medium
114537	GeoServer < 2.23.3 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	2024/12/10	2024/12/10	medium
414524	SCA: security update for org.geoserver:gs-restconfig (GHSA-fh7p-5f6g-vj2w)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	medium
414524	SCA: security update for org.geoserver:gs-restconfig (GHSA-fh7p-5f6g-vj2w)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium