CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-43709 – Elasticsearch allocation of resources without limits or throttling leads to crash
https://notcve.org/view.php?id=CVE-2024-43709
21 Jan 2025 — An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function. • https://discuss.elastic.co/t/elasticsearch-7-17-21-and-8-13-3-security-update-esa-2024-25/373442 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-49921
https://notcve.org/view.php?id=CVE-2023-49921
26 Jul 2024 — An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsea... • https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23450 – Elasticsearch Uncontrolled Resource Consumption vulnerability
https://notcve.org/view.php?id=CVE-2024-23450
27 Mar 2024 — A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash. Se descubrió una falla en Elasticsearch, donde el procesamiento de un documento en una canalización profundamente anidada en un nodo de ingesta podría provocar que el nodo Elasticsearch fallara. • https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-46674 – Elasticsearch-hadoop Unsafe Deserialization
https://notcve.org/view.php?id=CVE-2023-46674
05 Dec 2023 — An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue. Se identificó un problema que permitía la deserialización insegura de objetos Java desde propiedades de configuración de Hadoop o Spark que podrían haber sido modificadas por usuarios autenticados. Elastic quisiera agradecer a Yakov ... • https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-46673
https://notcve.org/view.php?id=CVE-2023-46673
22 Nov 2023 — It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API. Se identificó que los scripts con formato incorrecto utilizados en el procesador de scripts de una canalización de ingesta podrían provocar que un nodo de Elasticsearch fallara al llamar a la API Simulate Pipeline. • https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 4.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-31417 – Elasticsearch Insertion of sensitive information in audit logs
https://notcve.org/view.php?id=CVE-2023-31417
26 Oct 2023 — Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that cou... • https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-31418 – Elasticsearch uncontrolled resource consumption
https://notcve.org/view.php?id=CVE-2023-31418
26 Oct 2023 — An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild. Se identificó un problema con la forma en que Elasticsearch manejó las solicitudes entrantes en la capa HTTP. Un usuario no a... • https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 3CVE-2023-31419 – Elasticsearch StackOverflow vulnerability
https://notcve.org/view.php?id=CVE-2023-31419
22 Sep 2023 — A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. Se descubrió una falla en Elasticsearch que afectaba a la API _search y permitía que una cadena de consulta especialmente manipulada provocara un desbordamiento de pila y, en última instancia, una denegación de servicio. • https://packetstorm.news/files/id/174807 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-22144
https://notcve.org/view.php?id=CVE-2021-22144
26 Jul 2021 — In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node. En Elasticsearch versiones anteriores a 7.13.3 y la 6.8.17, se ha identificado una vulnerabilidad de recursión no controlada que podía conllevar a un ataque de denegación de servici... • https://discuss.elastic.co/t/elasticsearch-7-13-3-and-6-8-17-security-update/278100 • CWE-674: Uncontrolled Recursion •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22137 – elasticsearch: Document disclosure flaw when Document or Field Level Security is used
https://notcve.org/view.php?id=CVE-2021-22137
13 May 2021 — In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices. En Elasticsearch versiones anteriores a 7.11.2 y la 6.8.... • https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-281: Improper Preservation of Permissions •