GHSA-2p76-gc46-5fvc

Suggest an improvement
Source
https://github.com/advisories/GHSA-2p76-gc46-5fvc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-2p76-gc46-5fvc/GHSA-2p76-gc46-5fvc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2p76-gc46-5fvc
Related
Published
2025-06-10T20:10:42Z
Modified
2026-02-04T03:17:55Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L CVSS Calculator
Summary
GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
Details

Impact

GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation.

This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files

Patches

GeoNetwork 4.4.8 / 4.2.13.

Workarounds

Remove the gn-wfsfeature-harvester and gn-camelPeriodicProducer jars, disabling the WFS Index functionality.

References

Database specific 
{
    "cwe_ids": [
        "CWE-611",
        "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-10T20:10:42Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

Maven
org.geonetwork-opensource:gn-web-app

Package

Name
org.geonetwork-opensource:gn-web-app
View open source insights on deps.dev
Purl
pkg:maven/org.geonetwork-opensource/gn-web-app

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.4.0
Fixed
4.4.8

Database specific

last_known_affected_version_range 
"<= 4.4.7"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-2p76-gc46-5fvc/GHSA-2p76-gc46-5fvc.json"
org.geonetwork-opensource:gn-web-app

Package

Name
org.geonetwork-opensource:gn-web-app
View open source insights on deps.dev
Purl
pkg:maven/org.geonetwork-opensource/gn-web-app

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
4.2.13

Database specific

last_known_affected_version_range 
"<= 4.2.12"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-2p76-gc46-5fvc/GHSA-2p76-gc46-5fvc.json"
org.geonetwork-opensource:gn-wfsfeature-harvester

Package

Name
org.geonetwork-opensource:gn-wfsfeature-harvester
View open source insights on deps.dev
Purl
pkg:maven/org.geonetwork-opensource/gn-wfsfeature-harvester

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.4.0
Fixed
4.4.8

Database specific

last_known_affected_version_range 
"<= 4.4.7"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-2p76-gc46-5fvc/GHSA-2p76-gc46-5fvc.json"
org.geonetwork-opensource:gn-wfsfeature-harvester

Package

Name
org.geonetwork-opensource:gn-wfsfeature-harvester
View open source insights on deps.dev
Purl
pkg:maven/org.geonetwork-opensource/gn-wfsfeature-harvester

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
4.2.13

Database specific

last_known_affected_version_range 
"<= 4.2.12"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-2p76-gc46-5fvc/GHSA-2p76-gc46-5fvc.json"