CVE-2021-28398

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScript method in harvesters/src/main/java/org/fao/geonet/kernel/harvest/harvester/localfilesystem/LocalFilesystemHarvester.java. The earliest affected version is 3.4.0.

• CWE-78

• https://geonetwork-opensource.org/Product
• https://geonetwork-opensource.org/manuals/trunk/en/overview/change-log/version-3.6.0.htmlPatch, Release Notes, Vendor Advisory
• https://github.com/geonetwork/core-geonetworkThird Party Advisory
• https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-cf8p-c88c-h9jfMitigation, Patch, Third Party Advisory
• https://geonetwork-opensource.org/Product
• https://geonetwork-opensource.org/manuals/trunk/en/overview/change-log/version-3.6.0.htmlPatch, Release Notes, Vendor Advisory
• https://github.com/geonetwork/core-geonetworkThird Party Advisory
• https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-cf8p-c88c-h9jfMitigation, Patch, Third Party Advisory

Published

Sep 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28377ChronoForums 2.0.11 allows av Directory Traversal to read ar…5.3
• CVE-2021-28378Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain…5.4
• CVE-2021-28379web/upload/UploadHandler.php in Vesta Control Panel (aka Ves…8.8
• CVE-2021-28380The aimeos (aka Aimeos shop and e-commerce framework) extens…5.4
• CVE-2021-28381The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 …9.8
• CVE-2021-28382Zoho ManageEngine Key Manager Plus before 6001 allows Stored…5.4
• CVE-2021-28399OrangeHRM 4.7 allows an unauthenticated user to enumerate th…5.3
• CVE-2021-28411An issue was discovered in getRememberedSerializedIdentity f…9.8
• CVE-2021-28417A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows…4.8
• CVE-2021-28418A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows…4.8
• CVE-2021-28419The "order_col" parameter in archive.php of SEO Panel 4.8.0 …7.2
• CVE-2021-28420A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows…4.8