CVE-2024-29198

—

CVSS 3.1

8.2 high

EPSS

2%p81

Published

Jun 10, 2025 (Jun 10, 2025)

Modified

Jun 17, 2026

Description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.

Vendors: osgeo
Products: geoserver
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.2%)

In the news0 stories

No ingested article mentions this CVE yet.