CVE-2023-46666CWE-284

Elastic Sharepoint Online Python Connector Improper Access Control

Medium · published October 26, 2023

CVSS v3.1
5.3
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the Sharepoint site through Elasticsearch.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00437 · 37.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-10-26T16:16Z
EPSS history
Timeline
  • 26 OCT 16:16Z
    Elastic Sharepoint Online Python Connector Improper Access Control
    cvelistv5