Medium severity · published Feb 11, 2025
CVE-2024-32037
GeoNetwork is a catalog application to manage spatially referenced resources
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geonetwork · Osgeo
before 4.2.10; 4.4.0 before 4.4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32037
Product
https://docs.geonetwork-opensource.org/4.4/api/search
Release Notes
https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.10
Release Notes
https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.5
Vendor Advisory
https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-52rf-25hq-5m33
More from Geonetwork
9.1
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data
7.2
CVE-2021-28398
A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting…
6.5
CVE-2022-50899
Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server