GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.
References
| Link | Resource |
|---|---|
| https://github.com/GeoNode/geonode/commit/2fdfe919f299b21f1609bf898f9dcfde58770ac0 | Patch |
| https://github.com/GeoNode/geonode/security/advisories/GHSA-mcmc-c59m-pqq8 | Exploit Third Party Advisory |
| https://github.com/GeoNode/geonode/commit/2fdfe919f299b21f1609bf898f9dcfde58770ac0 | Patch |
| https://github.com/GeoNode/geonode/security/advisories/GHSA-mcmc-c59m-pqq8 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/GeoNode/geonode/commit/2fdfe919f299b21f1609bf898f9dcfde58770ac0 - Patch | |
| References | () https://github.com/GeoNode/geonode/security/advisories/GHSA-mcmc-c59m-pqq8 - Exploit, Third Party Advisory |
07 Nov 2023, 04:09
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3. |
01 Jun 2023, 14:03
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:geosolutionsgroup:geonode:*:*:*:*:*:*:*:* | |
| First Time |
Geosolutionsgroup geonode
Geosolutionsgroup |
Information
Published : 2023-02-27 21:15
Updated : 2024-11-21 07:50
NVD link : CVE-2023-26043
Mitre link : CVE-2023-26043
CVE.ORG link : CVE-2023-26043
JSON object : View
Products Affected
geosolutionsgroup
- geonode
CWE
CWE-611
Improper Restriction of XML External Entity Reference