CVE-2024-27091 - CVE House
Back to Database
Status published Medium CVE-2024-27091

GeoNode stored XSS to full account takeover

Vulnerability Description

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-27091

Credits & Attribution

No credits recorded in the NVD database.

References

More from GeoNode

View All →
CVE-2023-42439
GeoNode SSRF Bypass to return internal host data
High 7.5
CVE-2023-40017
Geonode Server Side Request Forgery vulnerability
High 7.5
CVE-2023-28442
Geoserver for GeoNode sensitive information leak
High 7.5
CVE-2023-26043
XML External Entity (XXE) injection in GeoServer style upload functionality
Medium 6.5

Affected Vendor

Affected Software

geonode
Vulnerable Versions:
>= 3.2.0, < 4.2.3

Timeline

Official Publish: March 27th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact