PT-2018-16216 · Elastic · X-Pack Security

Published 2018-03-30 · Updated 2023-03-24 · CVE-2018-3822

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions X-Pack Security versions 6.2.0 through 6.2.2

Description The issue allows for a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacker might impersonate a legitimate user if the SAML Identity Provider allows self registration with arbitrary identifiers and the attacker can register an account with an identifier that shares a suffix with a legitimate account. Both conditions must be true to exploit this flaw.

Recommendations For versions 6.2.0 through 6.2.2, consider restricting the SAML Identity Provider to prevent self registration with arbitrary identifiers as a temporary workaround until a patch is available.

Fix

Improper Authentication

Path traversal

Weakness Enumeration

CWE-287

CWE-22

Related Identifiers

CVE-2018-3822

Affected Products

X-Pack Security

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-3822 · Security Note
• https://discuss.elastic.co/t/elastic-stack-6-2-3-security-update/124848 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3822 · Vendor Advisory