PT-2022-16218 · Elastic · Elasticsearch

Published 2022-03-03 · Updated 2024-03-06 · CVE-2022-23708

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch versions 7.16 through 7.17.0

Description A flaw was discovered in Elasticsearch's upgrade assistant, which occurs when upgrading from version 6.x to 7.x, disabling the in-built protections on the security index. This allows authenticated users with "*" index permissions access to this index.

Recommendations For versions 7.16 through 7.17.0, upgrade to 7.17.1 to resolve the issue. For users planning to upgrade from 6.x, use version 7.17.1 or later for the upgrade to avoid the vulnerability.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-264

Related Identifiers

BIT-ELASTICSEARCH-2022-23708

CVE-2022-23708

GHSA-PGQ6-CCQJ-HPQR

Affected Products

Elasticsearch

References · 11

• https://osv.dev/vulnerability/GHSA-pgq6-ccqj-hpqr · Vendor Advisory
• https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elasticsearch-2022-23708 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23708 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23708 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23708 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23708 · Security Note
• https://t.me/cibsecurity/38403 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220729-0003 · Note
• https://t.me/cvenotify/53586 · Telegram Post