PT-2019-18663 · Elastic · Elasticsearch

Publicado 2019-03-25 · Atualizado 2022-05-13 · CVE-2019-7611

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 5.6.15 Elasticsearch versions prior to 6.6.1

Description A permission issue was found when Field Level Security and Document Level Security are disabled and certain endpoints are used. If the elasticsearch.yml file has xpack.security.dls fls.enabled set to false, certain permission checks are skipped, potentially allowing an attacker to gain additional permissions against a restricted index. The issue arises when users perform actions involving the " aliases", " shrink", or " split" endpoints.

Recommendations For Elasticsearch versions prior to 5.6.15, update to version 5.6.15 or later to resolve the issue. For Elasticsearch versions prior to 6.6.1, update to version 6.6.1 or later to resolve the issue. As a temporary workaround, consider setting xpack.security.dls fls.enabled to true in the elasticsearch.yml file to enable Field Level Security and Document Level Security, and restrict access to the " aliases", " shrink", and " split" endpoints until a patch is applied.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2019-7611

GHSA-FJ32-6V7M-57PG

Produtos afetados

Elasticsearch

Referências · 6

• https://github.com/elastic/elasticsearch · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-7611 · Nota de Segurança
• https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 · Aviso do Fabricante
• https://elastic.co/community/security · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fj32-6v7m-57pg · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-7611 · Aviso do Fabricante