CVE-2023-46674 — Deserialization of Untrusted Data in Elasticsearch-hadoop

CWE-502 — Deserialization of Untrusted Data5 documents5 sources
Severity
7.8HIGHNVD
CNA6.0
EPSS
0.1%
top 80.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Elastic Elasticsearch-hadoopElastic Elasticsearch
Timeline
PublishedDec 5

Description

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5elastic/elasticsearch-hadoop1.3.0 — 7.17.11+1
▶NVDelastic/elasticsearch8.0.0 — 8.9.0+1

🔴Vulnerability Details

3
OSV
Elasticsearch-hadoop Unsafe Deserialization↗2023-12-05
▶
GHSA
Elasticsearch-hadoop Unsafe Deserialization↗2023-12-05
▶
CVEList
Elasticsearch-hadoop Unsafe Deserialization↗2023-12-05
▶

📋Vendor Advisories

1
Red Hat
elasticsearch-hadoop: unsafe deserialization of java objects↗2023-12-05
▶
CVE-2023-46674 — Deserialization of Untrusted Data | cvebase