GeoNetwork - Reflected Cross-Site Scripting

GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting XSS in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing...