In breve
- CVE-2024-32037 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda org.geonetwork-opensource:gn-services, geonetwork (osgeo).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.38%, superiore al 31.7% delle vulnerabilità.
- Correzione: aggiornare a 4.4.5, 4.2.10 o successiva.
Description
Impact
The search end-point response headers contain information about Elasticsearch software in use. This information is sensitive from a security point of view because it allows software used by the server to be easily identified.
Patches
GeoNetwork 4.4.5 / 4.2.10
Workarounds
None
References
Credits
NVD description
GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free