PT-2025-6397 · Unknown · Geonetwork+1

Jodygarnett + 1 · Published 2025-02-11 · Updated 2025-02-12 · CVE-2024-32037

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GeoNetwork versions prior to 4.2.10 GeoNetwork versions prior to 4.4.5

Description The search endpoint response headers in GeoNetwork contain information about the Elasticsearch software in use, allowing the software used by the server to be easily identified. This information is valuable from a security point of view.

Recommendations For versions prior to 4.2.10, update to version 4.2.10 or later to fix the issue. For versions prior to 4.4.5, update to version 4.4.5 or later to fix the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-32037

GHSA-52RF-25HQ-5M33

Affected Products

Elasticsearch

Geonetwork

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32037.json · Exploit
• https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-52rf-25hq-5m33 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-32037 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-32037 · Security Note
• https://osv.dev/vulnerability/GHSA-52rf-25hq-5m33 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32037 · Vendor Advisory
• https://github.com/geonetwork/core-geonetwork · Note
• https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.10 · Note
• https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.5 · Note
• https://docs.geonetwork-opensource.org/4.4/api/search · Note
• https://twitter.com/CVEnew/status/1889437667047494028 · Twitter Post
• https://t.me/cvedetector/17786 · Telegram Post