CVE-2024-12539
Elasticsearch Incorrect Authorization
概要
Elasticsearch Incorrect Authorization
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
elasticsearch
[{"type":"SEMVER","events":[{"introduced":"8.16.0"},{"fixed":"8.17.0"}]}]
参照URL
- advisory discuss.elastic.co
- web nvd.nist.gov