« Volver al listado

CVE-2024-32037

Estado: AnalizadaMedia (5.3)—

GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Osgeo — Geonetwork

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32037",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32037",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-12T15:37:36.526856Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 0,
          "attackVector": "NETWORK",
          "baseSeverity": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 0,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "geonetwork",
          "product": "core-geonetwork",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.2.10"
            },
            {
              "status": "affected",
              "version": ">= 4.4.0, < 4.4.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-02-11T22:15:27.930",
  "references": [
    {
      "url": "https://docs.geonetwork-opensource.org/4.4/api/search",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.10",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.5",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-52rf-25hq-5m33",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available."
    },
    {
      "lang": "es",
      "value": "GeoNetwork es una aplicación de catálogo para administrar recursos referenciados espacialmente. En versiones anteriores a 4.2.10 y 4.4.5, los encabezados de respuesta del endpoint de búsqueda contienen información sobre el software Elasticsearch en uso. Esta información es valiosa desde el punto de vista de la seguridad porque permite identificar fácilmente el software utilizado por el servidor. GeoNetwork 4.4.5 y 4.2.10 solucionan este problema. No se conocen workarounds."
    }
  ],
  "lastModified": "2026-06-17T07:29:09.630",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:osgeo:geonetwork:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EA5B186-5F02-461E-B114-D5C1EC91F148",
              "versionEndExcluding": "4.2.10"
            },
            {
              "criteria": "cpe:2.3:a:osgeo:geonetwork:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52C2F47C-1DBB-44FA-9261-434BC2317D79",
              "versionEndExcluding": "4.4.5",
              "versionStartIncluding": "4.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}