PT-2023-30154 · Unknown · Elasticsearch

Published 2023-11-22 · Updated 2024-03-06 · CVE-2023-46673

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description The issue arises from malformed scripts used in the script processor of an Ingest Pipeline, which can cause an Elasticsearch node to crash when calling the "Simulate Pipeline API" endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

BIT-ELASTICSEARCH-2023-46673

CVE-2023-46673

GHSA-285M-VHFQ-XX4H

Affected Products

Elasticsearch

References · 11

• https://osv.dev/vulnerability/CVE-2023-46673 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46673 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-46673 · Security Note
• https://osv.dev/vulnerability/GHSA-285m-vhfq-xx4h · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46673 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elasticsearch-2023-46673 · Vendor Advisory
• https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46673 · Vendor Advisory
• https://github.com/elastic/elasticsearch · Note
• https://t.me/cvenotify/61781 · Telegram Post