CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-8441
https://notcve.org/view.php?id=CVE-2017-8441
Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias. Elastic X-Pack Security versiones anteriores a 5.4.1 y 5.3.3 no siempre aplicaban correctamente la Seguridad de Nivel de Documento para los alias de índices. Este error podría permitir a un usuario con permisos restringidos visualizar datos a los que no debería tener acceso cuando realiza ciertas operaciones contra un alias de índice. • https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released https://www.elastic.co/community/security • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-279: Incorrect Execution-Assigned Permissions •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 0CVE-2017-8438
https://notcve.org/view.php?id=CVE-2017-8438
Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user specified in a run_as request. If a role has been created using a template that contains the _user properties, the behavior of run_as will be incorrect. Additionally if the run_as user specified does not exist, the transition will not happen. Las versiones 5.0.0 hasta 5.4.0 de Elastic X-Pack Security contienen un error de escalación de privilegios en la funcionalidad run_as. • https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released https://www.elastic.co/community/security • CWE-269: Improper Privilege Management CWE-284: Improper Access Control •