Cyber Resilience

CVE-2024-29198

High

Published: 10 June 2025

Published
10 June 2025
Modified
26 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0699 91.7th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-29198 is a high-severity SSRF (CWE-918) vulnerability in Osgeo Geoserver. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

GeoServer, an open source Java-based server for sharing and editing geospatial data, contains a server-side request forgery vulnerability (CWE-918) in its Demo request endpoint. The flaw is exploitable when a Proxy Base URL has not been configured and carries a CVSS 3.1 score of 7.5 reflecting network-accessible attack conditions with no required authentication or user interaction.

An unauthenticated remote attacker can submit crafted requests to the affected endpoint and force the server to issue outbound requests to arbitrary internal or external destinations, resulting in disclosure of sensitive information from resources that would otherwise be inaccessible.

Public advisories and the associated Jira tickets state that the issue is resolved by upgrading to GeoServer 2.24.4 or 2.25.2, which removes the TestWfsPost servlet. The referenced GitHub security advisory and OSGeo issue trackers provide the official patch guidance and version mappings.

EPSS for the CVE reached a peak of 0.1036 on 2026-04-06 before receding to the current value of 0.0699.

EU & UK References

Vulnerability details

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been…

more

set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
T1552.005 Cloud Instance Metadata API Credential Access
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.
attack.mitre.org →
Why these techniques?

Unauthenticated SSRF in public-facing GeoServer (T1190) enables internal network service enumeration (T1046) and access to cloud instance metadata for sensitive data (T1522).

Affected Assets

osgeo
geoserver
2.0.0 — 2.24.4 · 2.25.0 — 2.25.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection
addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation
addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring
addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

References