{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.18.5"},{"introduced":"2.19.0","last_affected":"2.19.2"}],"component":"org.geoserver:gs-main","cve_ids":["CVE-2021-40822"],"ecosystem":"Maven","epss":0.19259,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-rr33-j5p5-ppf8","id":"tcs_01M5N9CBZ4YAH06B6HG0TV0KGB","modified_at":"2023-11-08T04:06:49.139580Z","published_at":"2022-05-03T00:00:44Z","references":["https://osv.dev/vulnerability/GHSA-rr33-j5p5-ppf8","https://nvd.nist.gov/vuln/detail/CVE-2021-40822","https://github.com/geoserver/geoserver","https://github.com/geoserver/geoserver/compare/2.19.2...2.19.3","https://github.com/geoserver/geoserver/releases","https://osgeo-org.atlassian.net/browse/GEOS-10229","https://osgeo-org.atlassian.net/browse/GEOS-10229?focusedCommentId=83508"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-rr33-j5p5-ppf8","url":"https://osv.dev/vulnerability/GHSA-rr33-j5p5-ppf8"}],"summary":"GeoServer allows SSRF via the option for setting a proxy host"}