CVE-2024-23451
Assigner: elastic
Published: 2024-03-27T18:03:25.802Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Elasticsearch
repo: https://github.com/elastic/elasticsearch
vendor: Elastic
versions: lessThan: 8.13.0
status: affected
version: 8.10.0
versionType: semver
datePublic: 2024-03-27T17:52:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a&nbsp;malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID and the document ID. None of Elasticsearch REST API endpoints are affected by this issue.
value: Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID and the document ID. None of Elasticsearch REST API endpoints are affected by this issue.
impacts: capecId: CAPEC-1
descriptions: value: CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-863
description: CWE-863 Incorrect Authorization
type: CWE
source: discovery: UNKNOWN
title: Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model
x_generator: engine: Vulnogram 0.1.0-dev