Medium WID-SEC-2024-3718 1 CVE

Elasticsearch: Schwachstelle ermöglicht Offenlegung von Informationen

Published Dec 17, 2024 · Updated Dec 17, 2024 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Elasticsearch ausnutzen, um Informationen offenzulegen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 1

Medium 6.0

CVE-2024-12539

Elasticsearch Incorrect Authorization

An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.

Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Wolfi Maven

Dec 17, 2024

Revision history

2024-12-17 #1
Initiale Fassung

References

Elasticsearch Security Update vom 2024-12-17
https://discuss.elastic.co/t/elasticsearch-8-16-2-8-17-0-security-update/372091