From 6da04e6af7fd40e2cd887759b6b952fec5237ae4 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 10 Jun 2025 20:12:41 +0000
Subject: [PATCH] Publish GHSA-2p76-gc46-5fvc

---
 .../GHSA-2p76-gc46-5fvc.json                  | 141 ++++++++++++++++++
 1 file changed, 141 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/06/GHSA-2p76-gc46-5fvc/GHSA-2p76-gc46-5fvc.json

diff --git a/advisories/github-reviewed/2025/06/GHSA-2p76-gc46-5fvc/GHSA-2p76-gc46-5fvc.json b/advisories/github-reviewed/2025/06/GHSA-2p76-gc46-5fvc/GHSA-2p76-gc46-5fvc.json
new file mode 100644
index 00000000000..d04a532b03e
--- /dev/null
+++ b/advisories/github-reviewed/2025/06/GHSA-2p76-gc46-5fvc/GHSA-2p76-gc46-5fvc.json
@@ -0,0 +1,141 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2p76-gc46-5fvc",
+  "modified": "2025-06-10T20:10:42Z",
+  "published": "2025-06-10T20:10:42Z",
+  "aliases": [],
+  "summary": "GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint",
+  "details": "### Impact\n\nGeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation. \n\nThis vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files \n\n### Patches\n\nGeoNetwork 4.4.8 / 4.2.13.\n\n### Workarounds\n\nRemove the ``gn-wfsfeature-harvester`` and ``gn-camelPeriodicProducer``  jars, disabling the WFS Index functionality. \n\n### References\n\n- [GHSA-826p-4gcg-35vw](https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw)\n- https://github.com/geonetwork/core-geonetwork/pull/8757\n- https://github.com/geonetwork/core-geonetwork/pull/8803\n- https://github.com/geonetwork/core-geonetwork/pull/8812",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.geonetwork-opensource:gn-web-app"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.4.0"
+            },
+            {
+              "fixed": "4.4.8"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 4.4.7"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.geonetwork-opensource:gn-web-app"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.2.0"
+            },
+            {
+              "fixed": "4.2.13"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 4.2.12"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.geonetwork-opensource:gn-wfsfeature-harvester"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.4.0"
+            },
+            {
+              "fixed": "4.4.8"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 4.4.7"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.geonetwork-opensource:gn-wfsfeature-harvester"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.2.0"
+            },
+            {
+              "fixed": "4.2.13"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 4.2.12"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/geonetwork/core-geonetwork/pull/8757"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/geonetwork/core-geonetwork/pull/8803"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/geonetwork/core-geonetwork/pull/8812"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/geonetwork/core-geonetwork"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-611",
+      "CWE-918"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-06-10T20:10:42Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file