CVE-2023-26043

CVE-2023-26043 is an XXE injection in GeoNode’s GeoServer style upload pathway that can lead to an authenticated Arbitrary File Read. The vulnerability stems from the server-side parsing of user-supplied SLD files (style uploads) without proper entity resolution, enabling an attacker to read file...

CVE-2024-27091

GeoNode's Stored XSS in the rich text editor is confirmed across multiple sources. The issue allows an attacker to retrieve a victim's CSRF token and trigger an email-change request, potentially leading to account takeover. Root cause: vulnerable rich text editor that does not mitigate XSS; impac...

CVE-2023-28442

CVE-2023-28442 affects GeoNode (3 and 4) where anonymous users can retrieve sensitive configuration information from the Geoserver REST endpoint /geoserver/rest/about/status. Versions before 2.20.7 (also 2.19.6/2.18.7) are exposed due to Geoserver configuration for GeoNode leaving REST endpoints ...