High severity · published May 2, 2022
CVE-2021-40822
GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host
7.5
CVSS
19.3%
EPSS
No
On KEV
Description
GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)19.3% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geoserver · Osgeo
through 2.18.5; 2.19.0 before 2.19.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40822
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40822
Patch
https://github.com/geoserver/geoserver/compare/2.19.2...2.19.3
Release Notes
https://github.com/geoserver/geoserver/releases
Issue Tracking
https://osgeo-org.atlassian.net/browse/GEOS-10229
Issue Tracking
https://osgeo-org.atlassian.net/browse/GEOS-10229?focusedCommentId=83508
More from Geoserver
9.8
CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
9.8
CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
9.8
CVE-2023-43795
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data
9.8
CVE-2023-25157
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data
9.1
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data