PT-2017-18333 · Elastic · X-Pack Security

Publicado 2017-06-05 · Atualizado 2019-10-09 · CVE-2017-8441

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elastic X-Pack Security versions prior to 5.4.1 Elastic X-Pack Security versions prior to 5.3.3

Description The issue concerns the incorrect application of Document Level Security to index aliases, potentially allowing users with restricted permissions to view unauthorized data when performing certain operations against an index alias.

Recommendations For versions prior to 5.4.1, update to version 5.4.1 or later. For versions prior to 5.3.3, update to version 5.3.3 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-279

Identificadores relacionados

CVE-2017-8441

Produtos afetados

X-Pack Security

Referências · 5

• https://elastic.co/community/security · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8441 · Aviso do Fabricante
• https://elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8441 · Nota de Segurança
• https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 · Aviso do Fabricante