CVE-2026-39921

Katalog CVE

CVSS 6.3 · Medium EPSS 0,37%

Kerentanan Server-Side Request Forgery (SSRF) pada geosolutionsgroup geonode. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/geonode-ssrf-via-document-upload advisory pihak ketiga
• https://github.com/GeoNode/geonode/commit/4a852cfc1da732b10779b5bf5f087c8f02985571
• https://github.com/GeoNode/geonode/commit/9856cb5ab27e33c0adba9274f4cccf6d1f534bd1
• https://github.com/GeoNode/geonode/pull/14058
• https://github.com/GeoNode/geonode/releases/tag/4.4.5 product · release notes
• https://github.com/GeoNode/geonode/releases/tag/5.0.2 product · release notes