جزئیات آسیب‌پذیری

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.

• https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f x_refsource_CONFIRM
• https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4 x_refsource_MISC
• https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef x_refsource_MISC
• https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15 x_refsource_MISC
• https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10 x_refsource_MISC