PT-2017-18333 · Elastic · X-Pack Security

Published 2017-06-05 · Updated 2019-10-09 · CVE-2017-8441

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elastic X-Pack Security versions prior to 5.4.1 Elastic X-Pack Security versions prior to 5.3.3

Description The issue concerns the incorrect application of Document Level Security to index aliases, potentially allowing users with restricted permissions to view unauthorized data when performing certain operations against an index alias.

Recommendations For versions prior to 5.4.1, update to version 5.4.1 or later. For versions prior to 5.3.3, update to version 5.3.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-279

Related Identifiers

CVE-2017-8441

Affected Products

X-Pack Security

References · 5

• https://elastic.co/community/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8441 · Vendor Advisory
• https://elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8441 · Security Note
• https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 · Vendor Advisory