Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-46666 EUVD-2023-50857GHSA-v2hx-f34m-8276

Elastic Sharepoint Online Python Connector Improper Access Control

Published Oct 26, 2023 · Updated Sep 9, 2024 · Assigned by elastic

Description

An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the Sharepoint site through Elasticsearch.

Affected products

VendorProductAffectedFixed
Elastic Elastic Sharepoint Online Python Connector <8.10.3.0 —

References