CVE-2023-28442

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18.7, anonymous users can obtain sensitive information about GeoNode configurations from the response of the `/geoserver/rest/about/status` Geoserver REST API endpoint. The Geoserver endpoint is secured by default, but the configuration of Geoserver for GeoNode opens a list of REST endpoints to support some of its public-facing services. The vulnerability impacts both GeoNode 3 and GeoNode 4 instances. Geoserver security configuration is provided by `geoserver-geonode-ext`. A patch for 2.20.7 has been released which blocks access to the affected endpoint. The patch has been backported to branches 2.20.6, 2.19.7, 2.19.6, and 2.18.7. All the published artifacts and Docker images have been updated accordingly. A more advanced patch has been applied to the master and development versions, which require some changes to GeoNode code. They will be available with the next 4.1.0 release. The patched configuration only has an effect on new deployments. For existing setups, the patch must be applied manually inside the Geoserver data directory. The patched file must replace the existing `<geoserver_datadir>/security/rest.properties` file.

• CWE-200

• https://github.com/GeoNode/geonode/security/advisories/GHSA-87mh-vw7c-5v6wMitigation, Patch, Vendor Advisory
• https://github.com/GeoNode/geoserver-geonode-ext/blob/2.20.7/data/security/rest.propertiesPatch, Vendor Advisory
• https://github.com/GeoNode/geoserver-geonode-ext/commit/f44cb074d8361c0f4e625013675bdd7bd8203df6Patch
• https://github.com/GeoNode/geonode/security/advisories/GHSA-87mh-vw7c-5v6wMitigation, Patch, Vendor Advisory
• https://github.com/GeoNode/geoserver-geonode-ext/blob/2.20.7/data/security/rest.propertiesPatch, Vendor Advisory
• https://github.com/GeoNode/geoserver-geonode-ext/commit/f44cb074d8361c0f4e625013675bdd7bd8203df6Patch

Published

Mar 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28437Dataease is an open source data visualization and analysis t…9.8
• CVE-2023-28438Pimcore is an open source data and experience management pla…8
• CVE-2023-28439CKEditor4 is an open source what-you-see-is-what-you-get HTM…6.1
• CVE-2023-2844Authorization Bypass Through User-Controlled Key in GitHub r…4.9
• CVE-2023-28440Discourse is an open source platform for community discussio…2.7
• CVE-2023-28441smartCARS 3 is flight tracking software. In version 0.5.8 an…7.5
• CVE-2023-28443Directus is a real-time API and App dashboard for managing S…5.5
• CVE-2023-28444angular-server-side-configuration helps configure an angular…7.5
• CVE-2023-28445Deno is a runtime for JavaScript and TypeScript that uses V8…9.8
• CVE-2023-28446Deno is a simple, modern and secure runtime for JavaScript a…8.8
• CVE-2023-28447Smarty is a template engine for PHP. In affected versions sm…6.1
• CVE-2023-28448Versionize is a framework for version tolerant serializion/d…7.5