漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
Vulnerability Description
A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScript method in harvesters/src/main/java/org/fao/geonet/kernel/harvest/harvester/localfilesystem/LocalFilesystemHarvester.java. The earliest affected version is 3.4.0.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
GeoNetwork 操作系统命令注入漏洞
Vulnerability Description
GeoNetwork是GeoNetwork开源的一个目录应用程序。用于管理空间参考资源。 GeoNetwork 3.12.0 之前版本和 4.x系列 4.0.4之前版本存在安全漏洞，攻击者利用该漏洞可以使用目录收集器 before-script 在托管基础设施上远程执行任意操作系统命令。
CVSS Information
N/A
Vulnerability Type
N/A