Vulnerability Intelligence Report
GeoNetwork vulnerable to search end-point information disclosure in response headers
CVE-2024-32037
GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.
No Active Exploit Signals
CVSS Base Score
N/A
NONE
Exploitability:3.9
Impact Score:0.0
EPSS Probability:0.35%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-200 ↗CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| geonetwork | core-geonetwork | < 4.2.10 (affected), >= 4.4.0, < 4.4.5 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.351%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2024-04-09T15:29:35 |
| Published | 2025-02-11T21:50:29 |
| Last Updated | 2025-02-12T15:37:46 |
Community Chatter & Buzz