Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-43795

72
FAUCET Score

CVE-2023-43795 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting GeoServer, an open-source Java-based geospatial data server. This flaw, stemming from the OGC Web Processing Service (WPS) specification's handling of GET and POST requests, allows attackers to force the server to make requests to arbitrary locations. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low complexity and no user interaction, potentially leading to full compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or KEV listing, a Nuclei template exists for detection, indicating potential for future exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.22.5CPE matchmatch criteria
cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*
>= 2.23.0, < 2.23.2CPE matchmatch criteria
cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.6HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
Exploitability Score
3.9
Impact Score
4.7
CvssVersion
3.1

Exploit Intelligence

EPSS Score
67.72%
Probability of exploitation in next 30 days
EPSS Percentile
99.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
Nuclei: CVE-2023-43795 · Nov 2, 2023
This CVE's current EPSS score of 0.6772 is in the 97th percentile among its peer group of 36,897 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

mavenpatch availablevia ghsa
Product: org.geoserver.extension:gs-wps-coreFixed in: 2.22.5
mavenpatch availablevia ghsa
Product: org.geoserver.extension:gs-wps-coreFixed in: 2.23.2
github_advisoryworkaround availablevia nvd_reference
View patch

Vendor Advisories (1)

mavenGHSA-5pr3-m5hm-9956high

WPS Server Side Request Forgery vulnerability

Oct 24, 2023

References

github.com / geoserver/geoserver/security/advisories/GHSA-5pr3-m5hm-9956
MitigationVendor Advisory