GeoNetwork search end-point information disclosure in response headers

中 5.3CVE-2024-32037 · GHSA-52rf-25hq-5m33 · 11/02/2025 公開 · 17/06/2026 更新

要点

CVE-2024-32037 は org.geonetwork-opensource:gn-services, geonetwork (osgeo) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.38%（全脆弱性の 31.7% より高い）。
対処：4.4.5, 4.2.10 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.geonetwork-opensource:gn-services Maven	`≥ 4.4.0, < 4.4.5< 4.2.10`	`4.4.54.2.10`
geonetwork osgeo	`≥ 4.4.0, < 4.4.5< 4.2.10`	`4.4.54.2.10`

概要

Impact

The search end-point response headers contain information about Elasticsearch software in use. This information is sensitive from a security point of view because it allows software used by the server to be easily identified.

Patches

GeoNetwork 4.4.5 / 4.2.10

Workarounds

None

References

Credits

Ministry of Economic Affairs and Climate Policy, The Netherlands.

NVD の説明

GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.