CVE-2024-23643: 
Java vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability (CVE-2024-23643) was discovered in GeoServer, an open source software server written in Java that allows users to share and edit geospatial data. The vulnerability specifically affects the GWC (GeoWebCache) Seed Form component and was disclosed on March 19, 2024 (GitHub Advisory).

The vulnerability enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog. This payload can then execute in the context of another administrator's browser when viewed in the GWC Seed Form. The issue stems from improper handling of special characters in the GWC Seed Form, which fails to properly escape user-controlled input (GeoWebCache Issue). The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Moderate) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (GitHub Advisory).

If successfully exploited, an attacker can perform any action within the application that the victim user can perform, view any information that the user is able to view, modify any information that the user is able to modify, and initiate interactions with other application users that will appear to originate from the initial victim user (GitHub Advisory).

The vulnerability requires high privileges (authenticated administrator with workspace-level privileges) and user interaction for successful exploitation. Access to the GWC Seed Form is limited to full administrators by default, and granting non-administrators access to this endpoint is not recommended (GitHub Advisory).

The vulnerability has been patched in GeoServer versions 2.23.2 and 2.24.1. Organizations using affected versions (< 2.23.2, < 2.24.1) should upgrade to the patched versions (GitHub Advisory).