CVE-2021-28398
A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScript method in harvesters/src/main/java/org/fao/geonet/kernel/harvest/harvester/localfilesystem/LocalFilesystemHarvester.java. The earliest affected version is 3.4.0.
| Software | From | Fixed in |
|---|---|---|
| osgeo / geonetwork | 4.0.0 | 4.0.4 |
| osgeo / geonetwork | 3.4.0 | 3.12.0 |
| osgeo / geonetwork | 4.0.0-alpha2 | 4.0.0-alpha2.x |
| osgeo / geonetwork | 4.0.0-alpha1 | 4.0.0-alpha1.x |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime