CVE-2017-8441CWE-279

Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases

published June 5, 2017

CVSS
—
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00733 · 53.6th percentile
Weakness
CWE-279 · Incorrect Execution-Assigned Permissions
Published
2017-06-05T14:00Z
EPSS history
Timeline
  • 05 JUN 14:00Z
    Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases
    cvelistv5