CVE-2023-43795

WPS Server Side Request Forgery in GeoServer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request Forgery. This vulnerability has been patched in version 2.22.5 and 2.23.2.

Affected

geoserver

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GITHUB

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS

68.45% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-918

Published

2023-10-24

Updated

2024-09-17

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43795.yaml

Security advisories

• geoserver/geoserver/security/advisories/GHSA-5pr3-m5hm-9956
• advisories/GHSA-5pr3-m5hm-9956

References

• CVE Record
• NVD entry