CVE-2024-12539
Elasticsearch Incorrect Authorization
Summary
Elasticsearch Incorrect Authorization
Original description
The description as published by the source.
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
elasticsearch
[{"type":"SEMVER","events":[{"introduced":"8.16.0"},{"fixed":"8.17.0"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- web discuss.elastic.co