Geoserver for GeoNode sensitive information leak
CVE-2023-28442
What is CVE-2023-28442?
GeoNode, an open-source platform for managing geospatial data, has a vulnerability that allows anonymous users to retrieve sensitive configuration data from the /geoserver/rest/about/status endpoint of the Geoserver REST API. While the Geoserver endpoint is secured by default, GeoNode's configuration inadvertently exposes additional REST endpoints, potentially allowing data leaks. This affects GeoNode versions prior to 2.20.6, 2.19.6, and 2.18.7, including all instances of GeoNode 3 and 4. A patch has been released that restricts access to the vulnerable endpoint, but existing setups require manual intervention to update the security properties file.
Affected Version(s)
geonode >= 2.20.0, < 2.20.6 < 2.20.0, 2.20.6
geonode >= 2.19.0, < 2.19.6 < 2.19.0, 2.19.6
geonode < 2.18.7 < 2.18.7