GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files ### Patches GeoNetwork 4.4.8 / 4.2.13. ### Workarounds Remove the ``gn-wfsfeature-harvester`` and ``gn-camelPeriodicProducer`` jars, disabling the WFS Index functionality. ### References - [GHSA-826p-4gcg-35vw](https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw) - https://github.com/geonetwork/core-geonetwork/pull/8757 - https://github.com/geonetwork/core-geonetwork/pull/8803 - https://github.com/geonetwork/core-geonetwork/pull/8812
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | org.geonetwork-opensource:gn-web-app (Maven) | 4.4.0 to before 4.4.8 | 4.4.8 | Patch available | GHSA-2p76-gc46-5fvc |
| — | org.geonetwork-opensource:gn-web-app (Maven) | 4.2.0 to before 4.2.13 | 4.2.13 | Patch available | GHSA-2p76-gc46-5fvc |
| — | org.geonetwork-opensource:gn-wfsfeature-harvester (Maven) | 4.4.0 to before 4.4.8 | 4.4.8 | Patch available | GHSA-2p76-gc46-5fvc |
| — | org.geonetwork-opensource:gn-wfsfeature-harvester (Maven) | 4.2.0 to before 4.2.13 | 4.2.13 | Patch available | GHSA-2p76-gc46-5fvc |
- org.geonetwork-opensource:gn-web-app (Maven) Vendor— Affected 4.4.0 to before 4.4.8 Fixed in 4.4.8 Patch available GHSA-2p76-gc46-5fvc
- org.geonetwork-opensource:gn-web-app (Maven) Vendor— Affected 4.2.0 to before 4.2.13 Fixed in 4.2.13 Patch available GHSA-2p76-gc46-5fvc
- org.geonetwork-opensource:gn-wfsfeature-harvester (Maven) Vendor— Affected 4.4.0 to before 4.4.8 Fixed in 4.4.8 Patch available GHSA-2p76-gc46-5fvc
- org.geonetwork-opensource:gn-wfsfeature-harvester (Maven) Vendor— Affected 4.2.0 to before 4.2.13 Fixed in 4.2.13 Patch available GHSA-2p76-gc46-5fvc
Remediation
- Fix · GHSA-2p76-gc46-5fvc org.geonetwork-opensource:gn-web-app (Maven) Fixed in 4.4.8 Advisory →
- Fix · GHSA-2p76-gc46-5fvc org.geonetwork-opensource:gn-web-app (Maven) Fixed in 4.2.13 Advisory →
- Fix · GHSA-2p76-gc46-5fvc org.geonetwork-opensource:gn-wfsfeature-harvester (Maven) Fixed in 4.4.8 Advisory →
- Fix · GHSA-2p76-gc46-5fvc org.geonetwork-opensource:gn-wfsfeature-harvester (Maven) Fixed in 4.2.13 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-2p76-gc46-5fvc
References
Other 6
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc
- https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw
- https://github.com/geonetwork/core-geonetwork/pull/8757
- https://github.com/geonetwork/core-geonetwork/pull/8803
- https://github.com/geonetwork/core-geonetwork/pull/8812
- https://github.com/geonetwork/core-geonetwork
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences