CVE-2023-26043 MEDIUM

CVE-2023-26043: XML External Entity (XXE) injection in GeoServer style upload functionality

Vendor Geonode
Product geonode
Weakness CWE-611 · XXE
Published February 27, 2023
Last update March 10, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.

Key dates

02Disclosure timeline

February 27, 2023 CVE published
March 10, 2025 Record updated