Executive brief
GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
Affected products
- Maven org.geoserver.web:gs-web-app
- Maven org.geoserver.main:gs-main
Junglewise Threat Intelligence
CVE-2024-34711: GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
CVE-2024-34711 · Severity: low · CVSS 3.1 · Published 2025-06-10
Technologies: org.geoserver.web:gs-web-app (Maven). Vendors: Maven.
Related threats
- GeoServer Server-Side Template Injection in FreeMarker templates
- GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format
- Coverage REST API Server Side Request Forgery
- Welcome and About GeoServer pages communicate version and revision information
- PartialBufferOutputStream2 flush issues