PT-2019-13330 · Floragunn · Search Guard

Published 2019-08-12 · Updated 2023-03-02 · CVE-2019-13418

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Search Guard versions prior to 24.0

Description The issue concerns the improper anonymization of string array values in documents. This affects the confidentiality of the data, as sensitive information may not be properly protected.

Recommendations For versions prior to 24.0, update to version 24.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive documents until the update can be applied.

Fix

Improper Validation of Array Index

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-129

CWE-311

Related Identifiers

CVE-2019-13418

Affected Products

Search Guard

References · 5

• https://search-guard.com/cve-advisory · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13418 · Security Note
• https://t.me/cvenotify/45360 · Telegram Post
• https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_0 · Note