PT-2024-21642 · Geonode · Geonode

Imthatt · Published 2024-03-27 · Updated 2025-12-19 · CVE-2024-27091

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GeoNode versions prior to 4.2.3

Description The issue exists within GeoNode, a geospatial content management system, where the current rich text editor is vulnerable to Stored XSS. This allows an attacker to retrieve a victim's CSRF token and issue a request to change another user's email address, potentially leading to a full account takeover. The script element does not impact the CORS policy, allowing requests to succeed.

Recommendations For versions prior to 4.2.3, update to version 4.2.3 to resolve the issue. As a temporary workaround, consider disabling the rich text editor until a patch is available. Restrict access to sensitive user account settings to minimize the risk of exploitation. Avoid using the vulnerable rich text editor in the affected GeoNode platform until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-27091

GHSA-RWCV-WHM8-FMXM

Affected Products

Geonode

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27091.json · Exploit
• https://github.com/GeoNode/geonode/security/advisories/GHSA-rwcv-whm8-fmxm · Vendor Advisory
• https://github.com/GeoNode/geonode/commit/e53bdeff331f4b577918927d60477d4b50cca02f · Patch
• https://osv.dev/vulnerability/CVE-2024-27091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27091 · Security Note
• https://twitter.com/CVEnew/status/1772975955222438082 · Twitter Post
• https://t.me/cveNotify/146381 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1772999563328024973 · Twitter Post
• https://twitter.com/RedPacketSec/status/1775086956076036350 · Twitter Post