CVE-2023-40017CWE-918

Geonode Server Side Request Forgery vulnerability

High · published August 24, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint `/proxy/?url=` does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and request information from internal hosts. A patch is available at commit a9eebae80cb362009660a1fd49e105e7cdb499b9.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00763 · 54.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-08-24T22:45Z
EPSS history
Timeline
  • 24 AUG 22:45Z
    Geonode Server Side Request Forgery vulnerability
    cvelistv5