CVE-2018-17244CWE-362

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP…

published December 20, 2018

CVSS
—
EPSS
1%
Percentile
73.3
In the wild
Unconfirmed
What it is

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01456 · 73.3th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2018-12-20T22:00Z
EPSS history
Timeline
  • 20 DEC 22:00Z
    Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP…
    cvelistv5