Sign in
Deutsch English Español Polski
Medium

GeoNode: Stored XSS to full account takeover

  • Disclosed: 27.03.2024
  • Updated: 11.10.2026 14:18

An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) geonode >= 3.2.1, < 4.2.3 4.2.3

References

CVSS score 6.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Python (PyPI)
Package
geonode
Disclosed
27.03.2024
Updated
11.10.2026 14:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2024-320 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-rwcv-whm8-fmxm - CC BY 4.0

Vulnerability history: geonode

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries
6
First → latest
02.2023 04.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 3
  • Medium 3

Disclosures per year

  1. GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outboun
    Medium · 6.3 CVE-2026-39921 >= 4.0.0, < 4.4.5, >= 5.0.0, < 5.0.2 4.4.5, 5.0.2
  2. GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
    Medium · 6.3 CVE-2026-39922 >= 4.0.0, < 4.4.5, >= 5.0.0, < 5.0.2 4.4.5, 5.0.2
  3. GeoNode: Stored XSS to full account takeover this entry
    Medium · 6.1 CVE-2024-27091 >= 3.2.1, < 4.2.3 4.2.3
  4. GeoNode vulnerable to SSRF Bypass to return internal host data
    High · 7.5 CVE-2023-42439 >= 3.2.0, < 4.1.3.post1 4.1.3.post1
  5. GeoNode Server Side Request forgery
    High · 7.5 CVE-2023-40017 >= 3.2.0, < 4.2.0 4.2.0
  6. GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection
    High · 6.5 CVE-2023-26043 < 4.0.3 4.0.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.