CVE-2023-28442

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-28442
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-28442.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-28442
Aliases
  • GHSA-87mh-vw7c-5v6w
Published
2023-03-23T23:10:49.688Z
Modified
2026-04-10T04:57:13.197505Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Geoserver for GeoNode sensitive information leak
Details

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18.7, anonymous users can obtain sensitive information about GeoNode configurations from the response of the /geoserver/rest/about/status Geoserver REST API endpoint. The Geoserver endpoint is secured by default, but the configuration of Geoserver for GeoNode opens a list of REST endpoints to support some of its public-facing services. The vulnerability impacts both GeoNode 3 and GeoNode 4 instances.

Geoserver security configuration is provided by geoserver-geonode-ext. A patch for 2.20.7 has been released which blocks access to the affected endpoint. The patch has been backported to branches 2.20.6, 2.19.7, 2.19.6, and 2.18.7. All the published artifacts and Docker images have been updated accordingly. A more advanced patch has been applied to the master and development versions, which require some changes to GeoNode code. They will be available with the next 4.1.0 release. The patched configuration only has an effect on new deployments. For existing setups, the patch must be applied manually inside the Geoserver data directory. The patched file must replace the existing <geoserver_datadir>/security/rest.properties file.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28442.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/geonode/geoserver-geonode-ext

Affected ranges

Type
GIT
Repo
https://github.com/geonode/geoserver-geonode-ext
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f44cb074d8361c0f4e625013675bdd7bd8203df6
Type
GIT
Repo
https://github.com/geonode/geoserver-geonode-ext
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f44cb074d8361c0f4e625013675bdd7bd8203df6

Affected versions

2.*
2.9.1
2.9.2

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2.18.7"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2.19.0"
            },
            {
                "fixed": "2.19.6"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2.20.0"
            },
            {
                "fixed": "2.20.6"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-28442.json"