GHSA-5mpw-4546-2wcrMedium

Elasticsearch Incorrect Authorization vulnerability

Published
December 17, 2024
Last Modified
December 17, 2024

🔗 CVE IDs covered (1)

📋 Description

An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.

🎯 Affected products1

  • maven/org.elasticsearch:elasticsearch:>= 8.16.0, < 8.16.2

🔗 References (3)