Kwetsbaarheden verholpen in GeoNetwork door OpenGeo
Multiple vulnerabilities have been fixed in GeoNetwork, an open-source catalog application maintained by OpenGeo. The affected versions include 4.4.5 through 4.4.11 and versions prior to 4.4.12 and 4.2.17. The vulnerabilities correspond to CWE-79 (Cross-site Scripting), CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), and CWE-862 (Missing Authorization). No CVSS score is provided, and no known exploits in the wild have been reported.
AI Analysis
Technical Summary
OpenGeo addressed multiple security vulnerabilities in GeoNetwork, specifically affecting versions 4.4.5 to 4.4.11 and versions before 4.4.12 and 4.2.17. The vulnerabilities include issues related to Cross-site Scripting (CWE-79), unsafe use of externally controlled input for code or class selection (CWE-470), and missing authorization checks (CWE-862). These issues could potentially allow unauthorized actions or code execution if exploited. The advisory is published by the Nationaal Cyber Security Centrum under advisory ID NCSC-2026-0343 and covers three CVEs: CVE-2026-57582, CVE-2026-58400, and CVE-2026-63219. No CVSS score or patch links are provided in the data.
Potential Impact
The vulnerabilities could allow attackers to perform unauthorized actions, inject malicious scripts, or manipulate code execution within affected GeoNetwork versions. This may lead to unauthorized access or compromise of the application environment. However, no known exploits in the wild have been reported, and the exact impact depends on the exploitation of the specific CWE issues.
Mitigation Recommendations
The vulnerabilities have been fixed in versions 4.4.12 and 4.2.17 of GeoNetwork. Users should upgrade to these or later versions to remediate the issues. Since no patch links are provided, users should consult the official GeoNetwork or OpenGeo channels and the Nationaal Cyber Security Centrum advisory NCSC-2026-0343 for detailed remediation instructions. No additional mitigation guidance is provided.
Kwetsbaarheden verholpen in GeoNetwork door OpenGeo
Description
Multiple vulnerabilities have been fixed in GeoNetwork, an open-source catalog application maintained by OpenGeo. The affected versions include 4.4.5 through 4.4.11 and versions prior to 4.4.12 and 4.2.17. The vulnerabilities correspond to CWE-79 (Cross-site Scripting), CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), and CWE-862 (Missing Authorization). No CVSS score is provided, and no known exploits in the wild have been reported.
Affected software
pkg:maven/org.geonetwork/geonetworkRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenGeo addressed multiple security vulnerabilities in GeoNetwork, specifically affecting versions 4.4.5 to 4.4.11 and versions before 4.4.12 and 4.2.17. The vulnerabilities include issues related to Cross-site Scripting (CWE-79), unsafe use of externally controlled input for code or class selection (CWE-470), and missing authorization checks (CWE-862). These issues could potentially allow unauthorized actions or code execution if exploited. The advisory is published by the Nationaal Cyber Security Centrum under advisory ID NCSC-2026-0343 and covers three CVEs: CVE-2026-57582, CVE-2026-58400, and CVE-2026-63219. No CVSS score or patch links are provided in the data.
Potential Impact
The vulnerabilities could allow attackers to perform unauthorized actions, inject malicious scripts, or manipulate code execution within affected GeoNetwork versions. This may lead to unauthorized access or compromise of the application environment. However, no known exploits in the wild have been reported, and the exact impact depends on the exploitation of the specific CWE issues.
Mitigation Recommendations
The vulnerabilities have been fixed in versions 4.4.12 and 4.2.17 of GeoNetwork. Users should upgrade to these or later versions to remediate the issues. Since no patch links are provided, users should consult the official GeoNetwork or OpenGeo channels and the Nationaal Cyber Security Centrum advisory NCSC-2026-0343 for detailed remediation instructions. No additional mitigation guidance is provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Nationaal Cyber Security Centrum
- Advisory Id
- NCSC-2026-0343
- Cve Count
- 3
- Additional Cves
- ["CVE-2026-58400","CVE-2026-63219"]
- Cvss Version
- null
Threat ID: 6a9ee1a9acd9273b49e69859
Added to database: 09/07/2026, 16:09:13 UTC
Last enriched: 09/07/2026, 16:14:05 UTC
Last updated: 09/07/2026, 21:20:37 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.