PT-2017-18340 · Elastic · X-Pack Alerting

Published 2017-09-28 · Updated 2019-10-09 · CVE-2017-8448

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions X-Pack Alerting versions 5.0.0 through 5.6.0

Description An issue was discovered in the permission model of X-Pack Alerting, where users assigned to specific built-in roles could create a watch, resulting in elevated privileges for that user.

Recommendations For versions 5.0.0 through 5.6.0, consider restricting the creation of watches for users mapped to certain built-in roles until a fix is available.

Fix

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

CVE-2017-8448

Affected Products

X-Pack Alerting

References · 3

• https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8448 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8448 · Security Note