Vulnerability Description
GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.
CVSS Score
NONE
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Osgeo | Geonetwork | < 4.2.10 |
Related Weaknesses (CWE)
References
- https://docs.geonetwork-opensource.org/4.4/api/searchProduct
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.10Release Notes
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.5Release Notes
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-52rf-25hqVendor Advisory
FAQ
What is CVE-2024-32037?
CVE-2024-32037 is a vulnerability with a CVSS score of 0.0 (NONE). GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch softw...
How severe is CVE-2024-32037?
CVE-2024-32037 has been rated NONE with a CVSS base score of 0.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-32037?
Check the references section above for vendor advisories and patch information. Affected products include: Osgeo Geonetwork.