CVE-2023-26043mediumCWE-611

CVE-2023-26043: fallo de gravedad media en geonode

XML External Entity (XXE) injection in GeoServer style upload functionality

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear geonode+ Monitorear geonode

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.8%
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
GeoNode · geonode
CVEs relacionadas — geonode

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-42439HIGHGeoNode SSRF Bypass to return internal host dataEPSS 1.0%CVE-2023-40017HIGHGeonode Server Side Request Forgery vulnerabilityEPSS 0.8%CVE-2026-33050HIGHGeoNode: OS command injection via uploaded file layer nameEPSS 0.7%CVE-2023-28442HIGHGeoserver for GeoNode sensitive information leakEPSS 0.6%CVE-2024-27091MEDIUMGeoNode stored XSS to full account takeoverEPSS 0.4%CVE-2026-55649MEDIUMGeoNode has Stored XSS in Documents metadata abstract fieldEPSS 0.3%