CVE-2024-27091mediumCWE-79

CVE-2024-27091: fallo de gravedad media en geonode

GeoNode stored XSS to full account takeover

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear geonode+ Monitorear geonode

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.4%
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
GeoNode · geonode
CVEs relacionadas — geonode

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-42439HIGHGeoNode SSRF Bypass to return internal host dataEPSS 1.0%CVE-2023-26043MEDIUMXML External Entity (XXE) injection in GeoServer style upload functionalityEPSS 0.8%CVE-2023-40017HIGHGeonode Server Side Request Forgery vulnerabilityEPSS 0.8%CVE-2026-33050HIGHGeoNode: OS command injection via uploaded file layer nameEPSS 0.7%CVE-2023-28442HIGHGeoserver for GeoNode sensitive information leakEPSS 0.6%CVE-2026-55649MEDIUMGeoNode has Stored XSS in Documents metadata abstract fieldEPSS 0.3%