CVE-2017-8446CWE-522

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability

published August 18, 2017

CVSS
—
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00695 · 52.4th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2017-08-18T20:00Z
EPSS history
Timeline
  • 18 AUG 20:00Z
    The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability
    cvelistv5