PT-2018-13964 · Elastic · Security
Publicado
2018-12-20
·
Atualizado
2022-05-13
·
CVE-2018-17244
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Elasticsearch Security versions 6.4.0 to 6.4.2
Description
The issue arises from an error in applying request headers to requests when using certain authentication realms, such as Active Directory, LDAP, Native, or File realms. If multiple requests for the same username are being authenticated at the same time, a request may receive headers intended for another request. This can lead to a situation where a request is executed under the wrong user, potentially allowing a user to access information they should not have access to.
Recommendations
For Elasticsearch Security versions 6.4.0 to 6.4.2, consider disabling the concurrent authentication feature for the affected realms as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.
Correção
Race Condition
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Security