CVE-2024-27091

Published: Mar 27, 2024Modified: Dec 19, 2025

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: security-advisories@github.com (Secondary)

Description

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.

Affected (1)

Products: Geosolutionsgroup: Geonode

Geosolutionsgroup

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Geosolutionsgroup Geonode	After 3.2.0 to 4.2.3

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/GeoNode/geonode/commit/e53bdeff331f4b577918927d60477d4b50cca02f

Source: security-advisories@github.com

Patch

https://github.com/GeoNode/geonode/security/advisories/GHSA-rwcv-whm8-fmxm

Source: security-advisories@github.com

Vendor Advisory

https://github.com/GeoNode/geonode/commit/e53bdeff331f4b577918927d60477d4b50cca02f

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/GeoNode/geonode/security/advisories/GHSA-rwcv-whm8-fmxm

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.