CVE-2023-41339

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an ``sld=<url>`` parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. This vulnerability can be used to steal user NetNTLMv2 hashes which could be relayed or cracked externally to gain further access. This vulnerability has been patched in versions 2.22.5 and 2.23.2.

• CWE-918
• CWE-918

• https://github.com/geoserver/geoserver/releases/tag/2.22.5Release Notes
• https://github.com/geoserver/geoserver/releases/tag/2.23.2Release Notes
• https://github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmfMitigation, Vendor Advisory
• https://github.com/geoserver/geoserver/releases/tag/2.22.5Release Notes
• https://github.com/geoserver/geoserver/releases/tag/2.23.2Release Notes
• https://github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmfMitigation, Vendor Advisory

Published

Oct 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41333Cilium is a networking, observability, and security solution…8.1
• CVE-2023-41334Astropy is a project for astronomy in Python that fosters in…8.4
• CVE-2023-41335Synapse is an open-source Matrix homeserver written and main…3.7
• CVE-2023-41336ux-autocomplete is a JavaScript Autocomplete functionality f…6.5
• CVE-2023-41337h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …6.7
• CVE-2023-41338Fiber is an Express inspired web framework built in the go l…5.3
• CVE-2023-4134A use-after-free vulnerability was found in the cyttsp4_core…5.5
• CVE-2023-41343Rogic No-Code Database Builder's file uploading function has…5.4
• CVE-2023-41344NCSIST ManageEngine Mobile Device Manager(MDM) APP's special…7.5
• CVE-2023-41345ASUS RT-AX55’s authentication-related function has a vulnera…8.8
• CVE-2023-41346ASUS RT-AX55’s authentication-related function has a vulnera…8.8
• CVE-2023-41347ASUS RT-AX55’s authentication-related function has a vulnera…8.8