CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-28398

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScript method in harvesters/src/main/java/org/fao/geonet/kernel/harvest/harvester/localfilesystem/LocalFilesystemHarvester.java. The earliest affected version is 3.4.0.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 55.9%

CVSS Severity

CVSS v3 Score 7.2

References

Products affected by CVE-2021-28398

Osgeo » Geonetwork » Version: 3.10.0

cpe:2.3:a:osgeo:geonetwork:3.10.0
Osgeo » Geonetwork » Version: 3.10.1

cpe:2.3:a:osgeo:geonetwork:3.10.1
Osgeo » Geonetwork » Version: 3.10.10

cpe:2.3:a:osgeo:geonetwork:3.10.10
Osgeo » Geonetwork » Version: 3.10.2

cpe:2.3:a:osgeo:geonetwork:3.10.2
Osgeo » Geonetwork » Version: 3.10.3

cpe:2.3:a:osgeo:geonetwork:3.10.3
Osgeo » Geonetwork » Version: 3.10.4

cpe:2.3:a:osgeo:geonetwork:3.10.4
Osgeo » Geonetwork » Version: 3.10.5

cpe:2.3:a:osgeo:geonetwork:3.10.5
Osgeo » Geonetwork » Version: 3.10.6

cpe:2.3:a:osgeo:geonetwork:3.10.6
Osgeo » Geonetwork » Version: 3.10.7

cpe:2.3:a:osgeo:geonetwork:3.10.7
Osgeo » Geonetwork » Version: 3.10.8

cpe:2.3:a:osgeo:geonetwork:3.10.8
Osgeo » Geonetwork » Version: 3.10.9

cpe:2.3:a:osgeo:geonetwork:3.10.9
Osgeo » Geonetwork » Version: 3.4.0

cpe:2.3:a:osgeo:geonetwork:3.4.0
Osgeo » Geonetwork » Version: 3.4.1

cpe:2.3:a:osgeo:geonetwork:3.4.1
Osgeo » Geonetwork » Version: 3.4.2

cpe:2.3:a:osgeo:geonetwork:3.4.2
Osgeo » Geonetwork » Version: 3.4.3

cpe:2.3:a:osgeo:geonetwork:3.4.3
Osgeo » Geonetwork » Version: 3.4.4

cpe:2.3:a:osgeo:geonetwork:3.4.4
Osgeo » Geonetwork » Version: 3.6.0

cpe:2.3:a:osgeo:geonetwork:3.6.0
Osgeo » Geonetwork » Version: 3.8.0

cpe:2.3:a:osgeo:geonetwork:3.8.0
Osgeo » Geonetwork » Version: 3.8.1

cpe:2.3:a:osgeo:geonetwork:3.8.1
Osgeo » Geonetwork » Version: 3.8.2

cpe:2.3:a:osgeo:geonetwork:3.8.2
Osgeo » Geonetwork » Version: 3.8.3

cpe:2.3:a:osgeo:geonetwork:3.8.3
Osgeo » Geonetwork » Version: 4.0.0

cpe:2.3:a:osgeo:geonetwork:4.0.0
Osgeo » Geonetwork » Version: 4.0.1

cpe:2.3:a:osgeo:geonetwork:4.0.1
Osgeo » Geonetwork » Version: 4.0.2

cpe:2.3:a:osgeo:geonetwork:4.0.2
Osgeo » Geonetwork » Version: 4.0.3

cpe:2.3:a:osgeo:geonetwork:4.0.3

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-28398

Products

Pricing

Contact Us