Vulnerability Intelligence Report
CVE-2021-28398
A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScript method in harvesters/src/main/java/org/fao/geonet/kernel/harvest/harvester/localfilesystem/LocalFilesystemHarvester.java. The earliest affected version is 3.4.0.
No Active Exploit Signals
CVSS Base Score
7.2
HIGH
EPSS Probability:1.09%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| osgeo | geonetwork | 4.0.0 |
Threat Intelligence Signals
EPSS Score
1.095%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2021-03-15T00:00:00 |
| Published | 2022-09-05T16:09:29 |
| Last Updated | 2024-08-03T21:40:14 |
Community Chatter & Buzz