PT-2017-18340 · Elastic · X-Pack Alerting

Publicado 2017-09-28 · Atualizado 2019-10-09 · CVE-2017-8448

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions X-Pack Alerting versions 5.0.0 through 5.6.0

Description An issue was discovered in the permission model of X-Pack Alerting, where users assigned to specific built-in roles could create a watch, resulting in elevated privileges for that user.

Recommendations For versions 5.0.0 through 5.6.0, consider restricting the creation of watches for users mapped to certain built-in roles until a fix is available.

Correção

Improper Access Control

Improper Privilege Management

Enumeração de Fraquezas

CWE-284

CWE-269

Identificadores relacionados

CVE-2017-8448

Produtos afetados

X-Pack Alerting

Referências · 3

• https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8448 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8448 · Nota de Segurança