CVE-2023-46674CWE-502

Elasticsearch-hadoop Unsafe Deserialization

Medium · published December 5, 2023

CVSS v3.1
6.0
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2023-12-05T17:21Z
EPSS history
Timeline
  • 05 DEC 17:21Z
    Elasticsearch-hadoop Unsafe Deserialization
    cvelistv5