CVE-2024-27091

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.

• CWE-79

• https://github.com/GeoNode/geonode/commit/e53bdeff331f4b577918927d60477d4b50cca02fPatch
• https://github.com/GeoNode/geonode/security/advisories/GHSA-rwcv-whm8-fmxmVendor Advisory
• https://github.com/GeoNode/geonode/commit/e53bdeff331f4b577918927d60477d4b50cca02fPatch
• https://github.com/GeoNode/geonode/security/advisories/GHSA-rwcv-whm8-fmxmVendor Advisory

Published

Mar 27, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27086The MSAL library enabled acquisition of security tokens to c…3.9
• CVE-2024-27087Kirby is a content management system. The new link field int…5.4
• CVE-2024-27088es5-ext contains ECMAScript 5 extensions. Passing functions …5.5
• CVE-2024-27089Rejected reason: This candidate was withdrawn by its CNA. Fu…
• CVE-2024-2709A vulnerability was found in Tenda AC10U 15.03.06.49. It has…8.8
• CVE-2024-27090Decidim is a participatory democracy framework, written in R…5.3
• CVE-2024-27092Hoppscotch is an API development ecosystem. Due to lack of …5.4
• CVE-2024-27093Minder is a Software Supply Chain Security Platform. In vers…7.5
• CVE-2024-27094OpenZeppelin Contracts is a library for secure smart contrac…7.4
• CVE-2024-27095Decidim is a participatory democracy framework. The admin pa…4.8
• CVE-2024-27096GLPI is a Free Asset and IT Management Software package, Dat…6.5
• CVE-2024-27097A user endpoint didn't perform filtering on an incoming para…5.3