CVE-2024-32037CWE-200

GeoNetwork vulnerable to search end-point information disclosure in response headers

published February 11, 2025

CVSS v3.1
0.0
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
0.0 · NONE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00377 · 30.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-02-11T21:50Z
EPSS history
Timeline
  • 11 FEB 21:50Z
    GeoNetwork vulnerable to search end-point information disclosure in response headers
    cvelistv5