CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-7611 – elasticsearch: Improper permission issue when attaching a new name to an index
https://notcve.org/view.php?id=CVE-2019-7611
25 Mar 2019 — A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a ... • https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 • CWE-284: Improper Access Control CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17244
https://notcve.org/view.php?id=CVE-2018-17244
20 Dec 2018 — Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to. Elasticsearch Security, de la versión 6.4.0 a la ... • http://www.securityfocus.com/bid/106318 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-3826
https://notcve.org/view.php?id=CVE-2018-3826
19 Sep 2018 — In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API. En Elasticsearch desde la versión 6.0.0-beta1 hasta la 6.2.4, se ha detectado una vulnerabilidad de divulgación en la API _snapshot. Cuando los parámetros access_key y security_key están configurados usando la API _snapshot, se pueden exponen como texto plano... • https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-311: Missing Encryption of Sensitive Data •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-3831 – elasticsearch: Information exposure via _cluster/settings API
https://notcve.org/view.php?id=CVE-2018-3831
19 Sep 2018 — Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details. Elasticsearch Alerting and Monitoring en versiones anteriores a la 6.4.1 o 5.6.12 tiene una vulnerabilidad de divulgación de inform... • https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •