CVSS: 5.2EPSS: 0%CPEs: 2EXPL: 0CVE-2023-49921
https://notcve.org/view.php?id=CVE-2023-49921
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical. • https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23449 – Elasticsearch Uncaught Exception
https://notcve.org/view.php?id=CVE-2024-23449
An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files. Se produce una excepción no detectada en Elasticsearch >= 8.4.0 y < 8.11.1 cuando se pasa un PDF cifrado a un procesador de archivos adjuntos a través de la API REST. El nodo de ingesta de Elasticsearch que intenta analizar el archivo PDF fallará. • https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458 • CWE-248: Uncaught Exception •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23450 – Elasticsearch Uncontrolled Resource Consumption vulnerability
https://notcve.org/view.php?id=CVE-2024-23450
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash. Se descubrió una falla en Elasticsearch, donde el procesamiento de un documento en una canalización profundamente anidada en un nodo de ingesta podría provocar que el nodo Elasticsearch fallara. • https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314 https://security.netapp.com/advisory/ntap-20240517-0010 https://www.elastic.co/community/security • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-46674 – Elasticsearch-hadoop Unsafe Deserialization
https://notcve.org/view.php?id=CVE-2023-46674
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue. Se identificó un problema que permitía la deserialización insegura de objetos Java desde propiedades de configuración de Hadoop o Spark que podrían haber sido modificadas por usuarios autenticados. Elastic quisiera agradecer a Yakov Shafranovich, de Amazon Web Services, por informar este problema. • https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-46673
https://notcve.org/view.php?id=CVE-2023-46673
It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API. Se identificó que los scripts con formato incorrecto utilizados en el procesador de scripts de una canalización de ingesta podrían provocar que un nodo de Elasticsearch fallara al llamar a la API Simulate Pipeline. • https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708 https://www.elastic.co/community/security • CWE-755: Improper Handling of Exceptional Conditions •