S4E just found a low-severity finding from missing http security headers implementation scanner

CVE

CVE-2024-29198

8.2

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

geoserver

Updated Sep 28, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~1 minutes

CVE-2024-29198 Scanner

CVE-2024-29198 Scanner - Server-Side-Request-Forgery (SSRF) vulnerability in GeoServer

Used 2.6k times · 3.3k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: geoserver

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →