PT-2017-18330 · Elastic · X-Pack Security

Publicado 2017-06-05 · Atualizado 2019-10-09 · CVE-2017-8438

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elastic X-Pack Security versions 5.0.0 to 5.4.0

Description The issue is related to a privilege escalation bug in the run as functionality. This bug affects the transitioning into a specified user in a run as request. If a role has been created using a template containing the user properties, the behavior of run as will be incorrect. Furthermore, if the specified run as user does not exist, the transition will not occur.

Recommendations For Elastic X-Pack Security versions 5.0.0 to 5.4.0, consider restricting the use of the run as functionality until a fix is available. As a temporary workaround, ensure that all roles are created without using templates that contain the user properties, and verify the existence of the run as user before attempting to transition.

Correção

Improper Access Control

Improper Privilege Management

Enumeração de Fraquezas

CWE-284

CWE-269

Identificadores relacionados

CVE-2017-8438

Produtos afetados

X-Pack Security

Referências · 5

• https://elastic.co/community/security · Aviso do Fabricante
• https://elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8438 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8438 · Aviso do Fabricante
• https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 · Aviso do Fabricante