CVE-2023-42439

PyPI/geonode CVE-2023-42439: high 7.5, EPSS 0.96%

GeoNode vulnerable to SSRF Bypass to return internal host data

Action: Upgrade geonode to 4.1.3.post1 or later.

pip install geonode==4.1.3.post1

Affected

Fixed versions

Sources

• osv: GHSA-pxg5-h34r-7q8p
• https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p
• https://nvd.nist.gov/vuln/detail/CVE-2023-42439
• https://github.com/GeoNode/geonode/commit/79ac6e70419c2e0261548bed91c159b54ff35b8d
• https://github.com/GeoNode/geonode
• https://github.com/GeoNode/geonode/releases/tag/4.1.3
• https://github.com/pypa/advisory-database/tree/main/vulns/geonode/PYSEC-2023-176.yaml

CVE-2023-42439 · published 2023-09-20T23:04:44Z · modified 2026-09-10T03:50:03.297287849Z · JSON

PyPI/geonode CVE-2023-42439: medium 6.5, EPSS 0.96%

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: PYSEC-2023-176
• https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p

CVE-2023-42439 · published 2023-09-15T21:15:00Z · modified 2025-10-09T08:24:28.295380Z · JSON