PT-2018-16223 · Elastic · Cloud Enterprise

CVE-2018-3829 · Publicado 2018-09-19 · Atualizado 2023-03-04

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elastic Cloud Enterprise (ECE) versions prior to 1.1.4

Description A security issue was found in Elastic Cloud Enterprise where a user could scale out allocators on new hosts using an invalid roles token. An attacker with access to the previous runner ID and IP address of the coordinator-host could exploit this to add an allocator to an existing ECE installation, potentially gaining access to other clusters' data.

Recommendations For versions prior to 1.1.4, update to version 1.1.4 or later to resolve the issue.

Correção

Improper Authorization

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-285

CWE-290

Identificadores relacionados

CVE-2018-3829

Produtos afetados

Cloud Enterprise

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-3829 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-3829 · Aviso do Fabricante
• https://elastic.co/community/security · Aviso do Fabricante
• https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778 · Aviso do Fabricante