Server-Side Request Forgery (SSRF) in geoserver - CVE-2023-41339
Published: October 24, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU129761
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-41339
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to server-side request forgery in the WMS endpoint when processing user-supplied sld URL parameters in GetMap, GetLegendGraphic, or GetFeatureInfo requests. A remote attacker can send a specially crafted request to disclose sensitive information.
Exploitation requires dynamic styling to be enabled and URL checks to be disabled or configured to allow file access.
Affected software
geoserver
How to mitigate CVE-2023-41339
Install security update from vendor's website.
geoserver - addressed in versions 2.22.5, 2.23.2