GitHub Advisoryadvisory · Maven

GHSA-pgq6-ccqj-hpqr Elasticsearch privilege escalation

MEDIUM Published 2022-03-04 Modified 2023-07-03 Official page ↗
Aliases
CVE-2022-23708
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-269
Reviewed
2022-03-04

Affected packages

• Maven org.elasticsearch:elasticsearch: >= 7.16.0, < 7.17.1 → fixed in 7.17.1

Description

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index. Users running a cluster on an affected version that had previously been upgraded from 6.x, should upgrade to 7.17.1. Users that are planning to upgrade from 6.x should not perform an upgrade from 6.x to versions 7.16 through 7.17.0 and should use 7.17.1+ for upgrades from 6.x.

Related

Alias · CVE (1)

  • CVE-2022-23708 A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References