CVE-2024-32037noneCWE-200

CVE-2024-32037: falha em geonetwork core-geonetwork

GeoNetwork vulnerable to search end-point information disclosure in response headers

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar core-geonetwork+ Monitorar org.geonetwork-opensource:gn-services

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 0epss 0.4%
GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Produtos afetados
geonetwork · core-geonetwork
CVEs relacionadas — geonetwork core-geonetwork

No mesmo produto, das mais perigosas para as menos.

CVE-2026-55864HIGHGeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD ToolEPSS 1.4%CVE-2026-58400CRITICALGeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatterEPSS 1.2%CVE-2026-53573MEDIUMcore-geonetwork has an Open Redirect BypassEPSS 0.6%CVE-2026-63219HIGHUnauthenticated file upload via missing authorization on formatter upload endpointEPSS 0.5%CVE-2026-46487HIGHGeoNetwork: ACL bypass on Elasticsearch search when request body omits query fieldEPSS 0.5%CVE-2026-39379HIGHGeoNetwork: Reflected XSS through client-side template injectionEPSS 0.4%