PT-2026-2375 · Geonetwork+2 · Geonetwork+1

Amel Bouziane-Leblond · Publicado 2026-01-13 · Atualizado 2026-02-27 · CVE-2022-50899

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Geonetwork versions 3.10 through 4.2.0

Description Geonetwork contains a flaw in its PDF rendering process related to XML external entities. This allows attackers to retrieve arbitrary files from the server. The issue stems from an insecure XML parser that can be exploited by crafting malicious XML documents with external entity references. Specifically, attackers can read system files through the baseURL parameter when making PDF creation requests.

Recommendations Versions prior to 4.2.1 should be updated.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2022-50899

Produtos afetados

Geonetwork

Core-Geonetwork

Referências · 6

• 🔥 https://exploit-db.com/exploits/50982 · Exploit
• https://vulncheck.com/advisories/geonetwork-xml-external-entity-xxe · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-50899 · Nota de Segurança
• https://t.me/cveNotify/153570 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-50899 · Aviso do Fabricante
• https://geonetwork-opensource.org · Nota