CVE-2019-7611 — Improper Access Control in Elasticsearch

CWE-284 — Improper Access ControlCWE-285 — Improper Authorization7 documents6 sources
Severity
8.1HIGHNVD
EPSS
0.7%
top 27.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Elasticsearch
Timeline
PublishedMar 25
Latest updateMay 13

Description

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permission…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

▶NVDelastic/elasticsearch6.0.0 — 6.6.1+1
▶CVEListV5elastic/elasticsearchbefore 5.6.15 and 6.6.1

🔴Vulnerability Details

3
GHSA
Improper Access Control in Elasticsearch↗2022-05-13
▶
OSV
Improper Access Control in Elasticsearch↗2022-05-13
▶
CVEList
CVE-2019-7611: A permission issue was found in Elasticsearch versions before 5↗2019-03-25
▶

📋Vendor Advisories

1
Red Hat
elasticsearch: Improper permission issue when attaching a new name to an index↗2019-02-19
▶

💬Community

2
Bugzilla
CVE-2019-7611 elasticsearch: Improper permission issue when attaching a new name to an index [fedora-all]↗2019-04-04
▶
Bugzilla
CVE-2019-7611 elasticsearch: Improper permission issue when attaching a new name to an index↗2019-04-04
▶
CVE-2019-7611 — Improper Access Control in Elastic | cvebase