GHSA-fqpv-mq26-pr4jMediumCVSS 5.5
GeoNode has Unrestricted File Upload
🔗 CVE IDs covered (1)
📋 Description
The upload service validation can be circumvented with specially crafted requests, allowing for the storage and serving of malicious files.
🎯 Affected products1
- pip/GeoNode:<= 5.0.2
🔗 References (7)
- https://github.com/GeoNode/geonode/security/advisories/GHSA-fqpv-mq26-pr4j
- https://github.com/GeoNode/geonode/pull/14223
- https://github.com/GeoNode/geonode/pull/14224
- https://github.com/GeoNode/geonode/commit/16ec8b3914fe87d0a258c14cf73b0a4295bb072f
- https://github.com/GeoNode/geonode/commit/239a6b49c925957197033831df5f20c4c13a14da
- https://github.com/GeoNode/geonode/releases/tag/5.0.3
- https://github.com/advisories/GHSA-fqpv-mq26-pr4j