WPS Server Side Request Forgery in GeoServer
CVE-2023-43795

9.8CRITICAL

Key Information:

Vendor

geoserver

Status
geoserver
Vendor
CVE Published:
25 October 2023

What is CVE-2023-43795?

GeoServer, an open source server for sharing and editing geospatial data, is susceptible to a Server Side Request Forgery vulnerability due to its handling of OGC Web Processing Service (WPS) requests. This weakness allows attackers to craft GET or POST requests that could exploit the server's trust and access internal resources or services. The issue has been resolved in GeoServer versions 2.22.5 and 2.23.2, highlighting the importance of updating to these patched versions to maintain security.

Affected Version(s)

geoserver < 2.22.5 < 2.22.5

geoserver >= 2.23.0, < 2.23.2 < 2.23.0, 2.23.2

References

https://github.com/geoserver/geoserver/security/advisorie...
x_refsource_CONFIRM

EPSS Score

90% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.