In short
- CVE-2024-32037 is a MEDIUM (CVSS 5.3) vulnerability affecting org.geonetwork-opensource:gn-services, geonetwork (osgeo).
- Chance of exploitation in the next 30 days (EPSS): 0.38%, higher than 31.7% of all vulnerabilities.
- Fix: update to 4.4.5, 4.2.10 or later.
Description
Impact
The search end-point response headers contain information about Elasticsearch software in use. This information is sensitive from a security point of view because it allows software used by the server to be easily identified.
Patches
GeoNetwork 4.4.5 / 4.2.10
Workarounds
None
References
Credits
NVD description
GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free