Server-Side Request Forgery (SSRF) in geoserver - CVE-2023-43795
Published: October 24, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU129758
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-43795
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper access control in the OGC Web Processing Service (WPS) Execute operation when processing complex remote inputs from external URL references. A remote attacker can submit a crafted request referencing an external URL to perform server-side request forgery.
Exploitation requires the WPS extension to be installed, the "Disable complex inputs" setting to be unselected, and security URL checks to be disabled.
Affected software
geoserver
How to mitigate CVE-2023-43795
Install security update from vendor's website.
geoserver - addressed in versions 2.22.5, 2.23.2