Search for packages
| purl | pkg:npm/geonode@3.2.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2uc9-efdk-93du
Aliases: CVE-2023-42439 GHSA-pxg5-h34r-7q8p PYSEC-2023-176 |
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed. The bypass will trick the application that the first host is a whitelisted address, but the browser will use `@` or `%40` as a credential to the host geoserver on port 8080, this will return the data to that host on the response. Version 4.1.3.post1 is the first available version that contains a patch. | There are no reported fixed by versions. |
|
VCID-pz62-4ruz-xbag
Aliases: CVE-2023-40017 GHSA-rmxg-6qqf-x8mr PYSEC-2023-269 |
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint `/proxy/?url=` does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and request information from internal hosts. A patch is available at commit a9eebae80cb362009660a1fd49e105e7cdb499b9. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-12T15:47:01.651709+00:00 | GitLab Importer | Affected by | VCID-2uc9-efdk-93du | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/geonode/CVE-2023-42439.yml | 38.6.0 |
| 2026-06-12T15:46:52.143028+00:00 | GitLab Importer | Affected by | VCID-pz62-4ruz-xbag | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/geonode/CVE-2023-40017.yml | 38.6.0 |