PT-2026-84458
CVE-2026-58400
·
تاريخ النشر
2026-09-01
·
تاريخ التحديث
2026-10-01
الوصف من
CVSS 3.1
9.1
حرجةالمقاييسAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
GeoNetwork versions prior to 4.4.12
GeoNetwork versions prior to 4.2.17
Description
The Saxon XSLT processor used to render formatters is configured without secure processing (
FEATURE SECURE PROCESSING) and without disabling Java extension functions (ALLOW EXTERNAL FUNCTIONS). This allows a user with sufficient privileges to upload a .xsl file containing Java extension calls to the java.lang.Runtime.exec() or java.lang.ProcessBuilder functions, leading to arbitrary command execution with the privileges of the GeoNetwork process user.Recommendations
Update to version 4.4.12 or later.
Update to version 4.2.17 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾