Threats tagged 'ghsa-rwcv-whm8-fmxm'

GeoNode versions 3.2.1 up to but not including 4.2.3 contain a stored cross-site scripting (XSS) vulnerability in the rich text editor. This vulnerability allows an attacker to retrieve a victim's CSRF token and perform actions such as changing the victim's email address, potentially leading to full account takeover. The vulnerability bypasses CORS policy restrictions due to the script element's behavior. The issue is classified as CWE-79 and has a moderate severity rating.