CVE-2023-43795: GeoServer WPS server-side request forgery

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and a high EPSS score make this a high-value target despite no KEV listing.

What it is

GeoServer's OGC Web Processing Service (WPS) accepts GET and POST requests and does not adequately restrict the targets it fetches, allowing server-side request forgery. Because the service is network-reachable and needs no credentials, an unauthenticated attacker can make the server issue requests on their behalf. The flaw is patched in GeoServer 2.22.5 and 2.23.2.

Impact

An attacker can force the GeoServer host to send requests to internal or external systems, reaching services that are not directly exposed and potentially reading internal resources or interacting with them under the server's identity. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network through the WPS endpoint using GET or POST requests; the CVSS vector shows no privileges and no user interaction required. Any deployment exposing WPS to untrusted networks is in scope.

Exploitation

Not listed in CISA KEV and no public exploit reference is provided, but EPSS is high at roughly 0.68 (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade GeoServer to 2.22.5 or 2.23.2, or a later release, as the primary fix.
• If immediate upgrade is not possible, apply the vendor advisory's mitigation guidance for the WPS endpoint.
• Restrict network access to the WPS endpoint to trusted clients and block outbound traffic from the GeoServer host to internal ranges.
• Run GeoServer with least privilege so a forged request cannot reach sensitive internal services.
• Monitor the vendor advisory for updated guidance.

Detection

• Review GeoServer and proxy logs for WPS GET/POST requests containing external or internal URLs as parameters.
• Alert on outbound connections from the GeoServer host to internal address ranges or unexpected destinations.
• Baseline normal WPS request patterns and flag anomalous request volumes or targets.
• Correlate GeoServer process network activity with HTTP request logs to spot SSRF-style fetches.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.