Back to Database
Status published
High
CVE-2023-43795
WPS Server Side Request Forgery in GeoServer
Vulnerability Description
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request Forgery. This vulnerability has been patched in version 2.22.5 and 2.23.2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-43795
Credits & Attribution
No credits recorded in the NVD database.
More from geoserver
View All →CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
High
8.2
CVE-2025-58175
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
Medium
6.5
CVE-2025-52465
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
High
7.2
CVE-2025-30220
GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Critical
9.9
CVE-2025-30145
GeoServer has an Infinite Loop Vulnerability in Jiffle process
High
7.5
Affected Vendor
geoserver
View all reports →Affected Software
geoserver
Vulnerable Versions:
< 2.22.5, >= 2.23.0, < 2.23.2
Timeline
Official Publish:
October 24th, 2023
Last Modified:
September 17th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L