CVE-2023-43795highobserved exploitationCWE-918

CVE-2023-43795: high-severity vulnerability in geoserver

WPS Server Side Request Forgery in GeoServer

Published · Updated

Follow this CVE+ Monitor geoserver+ Monitor org.geoserver.extension:gs-wps-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.6epss 69%
from disclosure to weapon
Published on NVDOct 24
VulnCheck+272d
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request Forgery. This vulnerability has been patched in version 2.22.5 and 2.23.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected products
geoserver · geoserver
Related CVEs — geoserver

In the same product, most dangerous first.

CVE-2024-36401CRITICALRemote Code Execution (RCE) vulnerability in evaluating property name expressions in GeoserverEPSS 99.8%KEVCVE-2025-58360HIGHGeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap featureEPSS 61.2%KEVCVE-2023-25157CRITICALUnfiltered SQL Injection Vulnerabilities in GeoserverEPSS 85.2%CVE-2025-30220CRITICALGeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handlingEPSS 43.6%CVE-2024-29198HIGHGeoServer Vulnerable to Unauthenticated SSRF via TestWfsPostEPSS 2.3%CVE-2023-51444HIGHGeoServer arbitrary file upload vulnerability in REST Coverage Store APIEPSS 1.9%