GitHub Advisoryadvisory · Maven

GHSA-vpqm-88c4-x4cv Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

MEDIUM Published 2022-05-13 Modified 2022-06-28 Official page ↗
Aliases
CVE-2018-17244
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-06-28

Affected packages

• Maven org.elasticsearch:elasticsearch: >= 6.4.0, < 6.4.3 → fixed in 6.4.3

Description

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to.

Related

Alias · CVE (1)

  • CVE-2018-17244 Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References