Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

GeoServer WPS can be tricked into contacting any site

CVE-2023-43795 · published 3 years ago
Summary

The Web Processing Service component of GeoServer can be abused to make the server send requests to arbitrary destinations. This could let an attacker cause the server to access internal systems or external resources without permission. Upgrade to GeoServer version 2.22.5 or later (or 2.23.2) to apply the fix.

What to do
  • Update geoserver org.geoserver.extension:gs-wps-core to version 2.22.5.
  • Update geoserver org.geoserver.extension:gs-wps-core to version 2.23.2.
Affected software
Ecosystem VendorProductAffected versions
maven geoserver org.geoserver.extension:gs-wps-core < 2.22.5
>= 2.23.0, < 2.23.2
Fix: upgrade to 2.22.5
– osgeo geoserver < 2.22.5
>= 2.23.0, < 2.23.2
cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*
Original advisory text
WPS Server Side Request Forgery in GeoServer
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request Forgery. This vulnerability has been patched in version 2.22.5 and 2.23.2.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.6 High
Exploitation
69% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published24 Oct 2023
Updated26 Oct 2026
First seen6 Mar 2026
Sources
GHSA-5pr3-m5hm-9956 · GHSA
CVE-2023-43795 · NVD
CVE-2023-43795 · OSV
Track software like this
Free during beta