{"id":"PYSEC-2023-176","details":"GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed. The bypass will trick the application that the first host is a whitelisted address, but the browser will use `@` or `%40` as a credential to the host geoserver on port 8080, this will return the data to that host on the response. As of time of publication, no patched version is available.","aliases":["CVE-2023-42439","GHSA-pxg5-h34r-7q8p"],"modified":"2025-10-09T08:24:28.295380Z","published":"2023-09-15T21:15:00Z","references":[{"type":"ADVISORY","url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p"}],"affected":[{"package":{"name":"geonode","ecosystem":"PyPI","purl":"pkg:pypi/geonode"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"}]}],"versions":["3.2.0","3.2.1","3.2.2","3.2.3","3.2.3.post1","3.2.4","3.3.0","3.3.1","3.3.1.post1","3.3.2","3.3.2.post1","3.3.2.post2","3.3.3","4.0.0","4.0.0.post1","4.0.0rc0","4.0.0rc1","4.0.1","4.0.2","4.0.3","4.1.0","4.1.1","4.1.2","4.1.3","4.1.3.post1","4.1.4","4.1.5","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.3.0","4.3.0.post1","4.3.1","4.4.0","4.4.1","4.4.2","4.4.3"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/geonode/PYSEC-2023-176.yaml"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}