{"action":"Upgrade org.geoserver:gs-wms to 2.22.5 (2.22.x) or 2.23.2 (2.23.x) or later.","affected":[{"fixed":"2.22.5","introduced":"0"},{"fixed":"2.23.2","introduced":"2.23.0"}],"component":"org.geoserver:gs-wms","cve_ids":["CVE-2023-41339"],"ecosystem":"Maven","epss":0.00632,"exploited":false,"fixed_versions":["2.22.5","2.23.2"],"ghsa_id":"GHSA-cqpc-x2c6-2gmf","id":"tcs_01M5N8T2V8S70R54VN0A9994PA","modified_at":"2024-03-06T23:57:16Z","published_at":"2023-10-24T19:20:34Z","references":["https://osv.dev/vulnerability/GHSA-cqpc-x2c6-2gmf","https://github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmf","https://nvd.nist.gov/vuln/detail/CVE-2023-41339","https://github.com/geoserver/geoserver","https://github.com/geoserver/geoserver/releases/tag/2.22.5","https://github.com/geoserver/geoserver/releases/tag/2.23.2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-cqpc-x2c6-2gmf","url":"https://osv.dev/vulnerability/GHSA-cqpc-x2c6-2gmf"}],"summary":"Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF"}