CVE-2024-35230: 
Java vulnerability analysis and mitigation

GeoServer, an open source software server written in Java for sharing and editing geospatial data, was found to contain a security vulnerability (CVE-2024-35230) where the welcome and about pages exposed sensitive version and revision information about the software and its components. This vulnerability affects versions prior to 2.26.0 and was disclosed on December 16, 2024 (GitHub Advisory).

The vulnerability is classified as an information disclosure issue (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). It has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can potentially expose sensitive information (GitHub Advisory).

The exposure of version and revision information about the software and its components through the welcome and about pages could allow attackers to easily identify the specific software versions being used by the server. This information could be leveraged to target known vulnerabilities in the identified software versions (GitHub Advisory).

The vulnerability has been patched in GeoServer version 2.26.0, and all users are advised to upgrade to this version. While there are no direct workarounds available, administrators can disable the ADMIN_CONSOLE completely as an extreme measure (GitHub Advisory).