Medium severity · published Feb 11, 2025
CVE-2024-32037
GeoNetwork vulnerable to search end-point information disclosure in response headers
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core-geonetwork · geonetwork
< 4.2.10; >= 4.4.0, < 4.4.5 · source: vendor
GE
Geonetwork · Osgeo
before 4.2.10; 4.4.0 before 4.4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32037
Product
https://docs.geonetwork-opensource.org/4.4/api/search
Release Notes
https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.10
Release Notes
https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.5
Vendor Advisory
https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-52rf-25hq-5m33
More from core-geonetwork
9.1
CVE-2026-58400
GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
8.6
CVE-2026-63219
Unauthenticated file upload via missing authorization on formatter upload endpoint
7.8
CVE-2026-55864
GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool
4.8
CVE-2026-53573
core-geonetwork has an Open Redirect Bypass